Published on August 11, 2026
GhostJacking Attacks Exploit AI Agents to Manipulate Infrastructure and Expose Cloud Credentials
Severity
Medium
Detail
Security researchers from Tenet have disclosed a new attack technique called GhostJacking, which abuses trusted observability, monitoring, and security platforms to influence AI coding and operations agents into performing unauthorized actions.
The research, presented at DEF CON 34, demonstrates how attacker-controlled content contained in logs, alerts, diagnostic events or issue reports can act as an indirect prompt injection. Instead of exploiting a conventional software vulnerability, the attacks abuse the permissions and trusted access already provided to AI agents connected to platforms such as Cloudflare, Datadog and Sentry.
How?
The attack can begin when an attacker sends a request that is blocked by a web application firewall. Although Cloudflare successfully blocks the request, attacker-controlled text contained in the request can still be recorded in the platform’s logs. If an analyst subsequently asks an AI agent to investigate the event, the agent may process the attacker-controlled content as if it were legitimate operational instructions.
In one demonstration involving Cloudflare, the researchers persuaded an AI agent to modify DNS settings. Such a change could potentially redirect an organization’s web or email traffic toward attacker-controlled infrastructure. Tenet reported that the technique succeeded in 9 out of 10 tests against Claude Code operating under a Cloudflare-recommended configuration.
A similar attack was demonstrated against Datadog. According to Tenet, publicly exposed client-side Datadog keys could allow an attacker to submit a specially crafted diagnostic event containing malicious instructions. When an engineer asks an AI agent to investigate the event, the agent may interpret the attacker-controlled content and execute the suggested command. In the researchers’ test, this resulted in unauthorized access to environment variables and cloud credentials.
The research also demonstrated agent-to-agent trust abuse involving Sentry’s Seer AI. An attacker-controlled report can influence Seer’s analysis, after which another coding agent may accept the AI-generated recommendation without examining the original malicious content. This can allow one trusted AI system to effectively validate and pass along an attacker’s instructions.
Tenet additionally disclosed a sandbox escape affecting Anthropic’s Claude Desktop. The issue could have allowed information collected by an AI agent to bypass intended network restrictions and reach attacker-controlled infrastructure. Anthropic confirmed the vulnerability and patched it before the DEF CON presentation.
Impact
GhostJacking can potentially allow attackers to manipulate AI agents into performing unauthorized infrastructure changes, executing attacker-controlled commands, and exposing sensitive information. Potential consequences include DNS manipulation, redirection of web and email traffic, unauthorized access to environment variables, and exposure of cloud credentials.
The technique is particularly concerning because the AI agent performs the actions using legitimate permissions, access tokens, and administrative tools. As a result, traditional security controls such as endpoint detection, identity and access management controls, and web application firewalls may have difficulty distinguishing the activity from legitimate administrative operations.
The attack concept is not limited to a particular security or monitoring product. Any environment where an AI agent consumes untrusted external information and has permission to perform privileged actions could potentially introduce a similar risk. Potentially affected workflows include monitoring systems, ticketing platforms, source-control environments, cloud management consoles and software build pipelines.
Recommendation
Organizations should treat all external data consumed by AI agents including logs, alerts, diagnostic events, issue reports and monitoring data as untrusted input. Tenet recommendation:
- Restricting or denying default outbound network access for AI agents.
- Requiring human approval before agents execute commands or make infrastructure changes.
- Separating read-only analysis capabilities from tools that can modify infrastructure.
- Treating every credential or access token available to an AI agent as potentially exposed.
- Reviewing the permissions granted to AI coding and operations agents and limiting them to the minimum required.
- Maintaining strong separation between untrusted data sources and privileged agent actions.
- Monitoring AI-agent activity for unexpected infrastructure modifications, command execution, or access to sensitive credentials.
Conclusion
GhostJacking demonstrates that AI agents can be manipulated without directly exploiting traditional software vulnerability. By placing malicious instructions inside trusted data sources such as logs, alerts, and diagnostic reports, attackers may influence AI agents that already possess legitimate permissions to access systems and perform administrative operations.
The research highlights the importance of treating AI-agent inputs, credentials, tools, and permissions as security boundaries. Organizations adopting AI agents for coding, monitoring, and infrastructure operations should implement strict access controls, human approval mechanisms, network restrictions, and separation between analysis and privileged actions to reduce the risk of indirect prompt-injection attacks.