Ghostjacking: AI Agents Turn Security Logs into Attack Vectors
Researchers at Tenet Security unveiled a new attack technique called Ghostjacking at DEF CON 34, exposing a critical flaw in AI-driven security workflows. The method exploits trusted operational data such as blocked web requests, monitoring alerts, and error logs to manipulate AI agents into executing malicious actions within enterprise environments.
The attack leverages architectural vulnerabilities in AI systems, where agents interpret attacker-controlled content in logs as legitimate instructions rather than untrusted evidence. In a demonstrated scenario involving Cloudflare, a blocked malicious request was logged, then processed by an AI assistant. The agent, misled by embedded attacker text, modified DNS records to redirect traffic to attacker-controlled infrastructure all while appearing as an authorized API call from a trusted identity.
Testing against Cloudflare’s recommended configuration revealed a 90% success rate with Claude Code. The consequences extend beyond traditional firewall bypasses: attackers gain control over DNS, email routing, and cloud credentials, enabling account takeovers without triggering conventional security alerts. Similar attack chains were demonstrated with Datadog and Sentry, where AI agents were tricked into executing commands or propagating malicious remediations across systems.
The kill chain includes privilege escalation, credential theft, and persistence via agent configuration changes. Tenet also disclosed a sandbox-escape vulnerability in Claude Desktop, which Anthropic patched prior to the presentation.
The findings highlight a broader "confused deputy" problem in AI systems, where agents granted high-level access to observability, ticketing, and cloud management tools fail to distinguish between data and hidden instructions. Traditional security tools like EDR, WAFs, and IAM systems may overlook these attacks, as they appear as valid actions by authorized identities.
The research underscores the need for stricter controls, including isolating read-only investigations from write operations, enforcing human approval for high-impact changes, and treating all externally influenced logs as untrusted input. Without these measures, AI agents risk becoming unwitting conduits for privilege escalation and lateral movement.
Source: https://cyberpress.org/new-ghostjacking-attacks-hijack-ai-agents/
Sentry AI cybersecurity rating report: https://www.rankiteo.com/company/sentryai
Cloudflare cybersecurity rating report: https://www.rankiteo.com/company/cloudflare
"id": "SENCLO1786454995",
"linkid": "sentryai, cloudflare",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Cybersecurity/Cloud Services',
'name': 'Cloudflare',
'type': 'Technology'},
{'industry': 'Monitoring/Observability',
'name': 'Datadog',
'type': 'Technology'},
{'industry': 'Error Monitoring',
'name': 'Sentry',
'type': 'Technology'},
{'industry': 'AI/LLM',
'name': 'Anthropic',
'type': 'Technology'}],
'attack_vector': 'Exploitation of AI-driven security workflows via trusted '
'logs and monitoring data',
'date_publicly_disclosed': '2024-08',
'description': 'Researchers at Tenet Security unveiled a new attack technique '
'called Ghostjacking at DEF CON 34, exposing a critical flaw '
'in AI-driven security workflows. The method exploits trusted '
'operational data such as blocked web requests, monitoring '
'alerts, and error logs to manipulate AI agents into executing '
'malicious actions within enterprise environments. The attack '
'leverages architectural vulnerabilities in AI systems, where '
'agents interpret attacker-controlled content in logs as '
'legitimate instructions rather than untrusted evidence. In a '
'demonstrated scenario involving Cloudflare, a blocked '
'malicious request was logged, then processed by an AI '
'assistant. The agent, misled by embedded attacker text, '
'modified DNS records to redirect traffic to '
'attacker-controlled infrastructure all while appearing as an '
'authorized API call from a trusted identity.',
'impact': {'operational_impact': 'Account takeovers, unauthorized '
'modifications to DNS and cloud '
'configurations',
'systems_affected': ['DNS', 'Email routing', 'Cloud credentials']},
'lessons_learned': "The findings highlight a broader 'confused deputy' "
'problem in AI systems, where agents granted high-level '
'access to observability, ticketing, and cloud management '
'tools fail to distinguish between data and hidden '
'instructions. Traditional security tools like EDR, WAFs, '
'and IAM systems may overlook these attacks, as they '
'appear as valid actions by authorized identities.',
'post_incident_analysis': {'corrective_actions': ['Patch sandbox-escape '
'vulnerability in Claude '
'Desktop (Anthropic)',
'Implement stricter '
'controls for AI agent '
'operations'],
'root_causes': 'Architectural vulnerabilities in '
'AI systems, where agents interpret '
'attacker-controlled content in '
'logs as legitimate instructions '
'rather than untrusted evidence'},
'recommendations': ['Stricter controls for AI agent operations',
'Isolating read-only investigations from write operations',
'Enforcing human approval for high-impact changes',
'Treating all externally influenced logs as untrusted '
'input'],
'references': [{'source': 'Tenet Security Research (DEF CON 34)'}],
'response': {'remediation_measures': ['Isolating read-only investigations '
'from write operations',
'Enforcing human approval for '
'high-impact changes',
'Treating all externally influenced '
'logs as untrusted input']},
'title': 'Ghostjacking: AI Agents Turn Security Logs into Attack Vectors',
'type': 'AI Agent Manipulation',
'vulnerability_exploited': 'Confused deputy problem in AI systems, failure to '
'distinguish between data and hidden instructions '
'in logs'}