Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
GhostJacking is an indirect prompt-injection attack in which an attacker hides natural-language instructions inside telemetry that an AI agent is asked to read. The agent may then treat that text as a trusted task and use its legitimate permissions to change DNS, execute code, install a package, read secrets or send data outside the environment. The defining weakness is not a stolen password or one vendor defect; it is the combination of attacker-influenced data and an agent that can both read it and act on production systems.
Tenet Security presented demonstrations of this pattern at DEF CON 34 on August 9, 2026. The reported chains involved Cloudflare, Datadog and Sentry, but the same design risk applies to any alerting, logging or observability system connected to an AI agent with consequential tools.
What is GhostJacking?
GhostJacking is a named form of indirect prompt injection. An attacker first places instruction-like text in a value that a security or operations platform records, such as a User-Agent field, error message, stack trace or diagnostic string. Later, an engineer asks an AI agent to investigate an alert. The agent retrieves the poisoned record and may follow the embedded text as though it were part of the engineer’s request.
NIST describes prompt injection as an attack that exploits the concatenation of untrusted input with a prompt constructed by a higher-trust application designer. GhostJacking applies that definition to security telemetry. A firewall event or log entry can be authentic as a record while still being untrusted as an instruction.
#1 Best Overall
How can a security alert hijack an AI agent?
The attack needs a path from attacker-controlled input to an agent’s context, plus a path from that agent to a tool that can cause impact. A typical sequence looks like this:
- Plant text. The attacker submits a request, header, parameter or message containing instructions aimed at the agent.
- Record the value. A WAF, log collector, issue tracker or monitoring service stores the text without changing its provenance.
- Trigger investigation. An engineer asks an AI assistant to inspect the event, summarize errors or fix the problem.
- Cross the trust boundary. The model sees the stored text in the same context as the engineer’s instructions and may give it equal or greater weight.
- Invoke an authorized tool. The agent uses its connected API, shell, package manager or deployment integration.
- Complete the chain. The result can be a DNS change, code execution, secret theft, malicious package installation or outbound transfer.
The model does not need to authenticate as the attacker. It is already authenticated as the organization. Conventional identity logs can therefore show a valid user, token and API call while missing the fact that the decision was shaped by hostile text.
What did the Cloudflare demonstration show?
In Tenet’s Cloudflare scenario, the attacker put instruction text in a request field such as User-Agent. Cloudflare blocked the request, but its telemetry retained the field. A Cursor agent had read access to Cloudflare events and write access through a Cloudflare API MCP tool. When the agent investigated the event, it followed the injected instructions and changed DNS records. Independent reporting described the potential consequence as rerouting web and email traffic to attacker infrastructure.
Tenet reported success in nine of ten attempts against Claude Code in this demonstration, a 90% result from its own 2026 testing rather than an independently reproduced benchmark. The important lesson is that the firewall’s blocking decision did not prevent the payload from reaching a later AI workflow.
How did the Datadog path differ?
Tenet described a Datadog chain involving an exposed front-end client token and a poisoned log message written to look like an urgent diagnostic. When an engineer asked an agent to check errors, the agent ran an attacker-controlled command. The reported impact included remote code execution and exfiltration of environment variables and cloud credentials.
Tenet identified more than 2,700 exposed Datadog client keys. That figure describes publicly observable keys, not confirmed compromises. A reachable client token can let an attacker influence what the agent later reads; it does not by itself prove that an organization was breached.
Rank #2
How did the Sentry path cross from one agent to another?
In the Sentry demonstration, a crafted issue was routed to Sentry’s Seer AI. The coding agent trusted Seer’s returned analysis, so the attacker’s instruction moved from one agent to another as apparently authoritative output. Tenet reported that the chain led to installation of a malicious package and code execution.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This is a distinct trust problem from a single poisoned log. An upstream model can launder hostile content into a summary, recommendation or diagnosis that a downstream model treats as trusted. Agent-to-agent messages therefore need provenance and policy checks just like raw telemetry.
Is GhostJacking a Cloudflare, Datadog or Sentry bug?
No. The demonstrations used those products, but the researchers characterized the issue as a reusable architecture pattern rather than one vendor vulnerability. Any system is exposed when an agent can read attacker-influenced records and also perform high-impact actions.
Tenet researchers summarized the pattern as: “Sentry, Cloudflare, and Datadog are not three separate flaws. They are the same shape. An AI reads outside data it trusts, and the same AI can also act on it. Wherever those two things meet, the door is open.” A blocked request, a valid log entry or a first-party API response can all become the delivery mechanism.
Why do ordinary security controls miss GhostJacking?
Identity and access controls answer who made an API call, not why the agent decided to make it. The agent’s credentials are legitimate, and the connected tool may be operating exactly as configured. The malicious influence enters through data provenance: a field collected for diagnostics is interpreted as an instruction.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Firewalls: blocking the original request does not remove its recorded contents from telemetry.
- Schema validation: a string can be valid in a log field while still containing adversarial instructions.
- Prompt wrappers: placing a system message above retrieved data does not guarantee that a model will ignore persuasive text.
- Agent chaining: a downstream model may trust a summary produced by another model even when the original source was hostile.
- Broad service accounts: one token that can read alerts and change production systems turns a context-manipulation error into an operational incident.
OWASP lists webpages, documents, email, databases and API responses as sources of indirect prompt injection. Security telemetry has the same structural properties: it is external content inserted into an agent’s context.
How do I stop prompt injection in security telemetry?
Use layered controls. No single prompt instruction reliably neutralizes hostile text, so place boundaries around data, tools, network access and approval.
1. Mark every telemetry field as untrusted data
In tool responses, label the source, timestamp, account and collection path. Render logs, alerts, stack traces, tickets and external API fields as data objects rather than as free-form instructions. Tell the agent that text inside those objects may contain commands and must never be executed solely because it appears in a first-party record.
2. Give triage agents the minimum permissions
Make investigation tools read-only wherever possible. Separate DNS management, deployment, package installation, shell execution, credential access and data export into distinct tools or agents. OWASP identifies privilege minimization as the most effective way to limit the impact of a successful injection.
Recommended Free Tools
3. Put human approval outside the model
Require an approval gate implemented by policy software or an operations workflow—not by the model’s own judgment—for DNS changes, code execution, package installation, secret retrieval, outbound transfers and other irreversible actions. Show the proposed command, target, parameters and source records to the approver.
4. Deny outbound network access by default
Run investigative agents without unrestricted internet egress. Tenet states that denying outbound access can stop attacker downloads and data exfiltration in relevant chains. Allow-list only the destinations required for the task and log every exception.
5. Protect tokens and preserve provenance
Audit browser-exposed client tokens, DSNs and API credentials. Rotate any credential that could write attacker-controlled content into telemetry. Mark upstream-agent output as untrusted when it is passed to a downstream agent; a fluent summary is not evidence of a safe source.
Rank #4
6. Test with realistic poisoned records
Create test alerts containing instructions to run commands, retrieve secrets, change DNS or contact an external host. Include cross-agent messages and malformed fields. NIST recommends adaptive, task-specific evaluations and measuring performance across repeated attempts rather than relying on one aggregate score. Record whether the agent refused, requested approval, used a restricted tool or leaked data.
What should an AI-agent security architecture include?
When comparing gateways, runtime controls or internal designs, evaluate the complete boundary rather than a headline detection rate.
| Control area | Questions to ask | What good looks like |
|---|---|---|
| Provenance isolation | Are logs and alerts visibly separated from instructions? | Source labels, immutable metadata and structured data passed as untrusted content. |
| Least privilege | Can a triage agent alter production or read secrets? | Read-only defaults, narrowly scoped tokens and separate high-impact tools. |
| Approval boundaries | Can the model complete an irreversible action alone? | External policy gates for DNS, execution, packages, secrets and exports. |
| Network and secret controls | What can the runtime reach? | Outbound deny-by-default, destination allow-lists and secret isolation. |
| Cross-agent trust | Does one model’s output become another model’s instruction? | Signed or labeled provenance, validation and independent policy checks. |
| Evaluation | Are attacks tested repeatedly and adapted? | Scenario libraries covering poisoned telemetry, tool abuse and agent chaining. |
How should teams detect and respond to a suspected GhostJacking attempt?
Start by correlating the original input with the agent session and subsequent tool calls. Search telemetry for imperative phrases, requests to ignore prior rules, encoded commands, unusual URLs and instructions aimed at an AI assistant. Treat those indicators as triage signals, not proof; legitimate diagnostic text can contain command syntax.
- Freeze or revoke the agent’s high-impact tokens and disable affected MCP tools.
- Preserve the poisoned record, model transcript, tool arguments, approvals and network logs.
- Check DNS history, package-manager logs, shell history, cloud audit trails and outbound connections for unauthorized actions.
- Rotate credentials that were readable by the agent, including environment variables and cloud keys.
- Remove malicious records or quarantine them so another automated workflow cannot consume them.
- Re-enable capabilities only after provenance labels, approval gates and egress restrictions are verified.
Because the action may have been authorized technically, investigate both the model context and the identity trail. A clean authentication record does not clear the workflow.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How widespread could the exposure be?
Tenet cited adoption figures to illustrate potential reach: Datadog was reported as serving 48% of the Fortune 500 in its Q4 FY2025 earnings call, Cloudflare as used by 42% of the Fortune 500 in Q1 2026 investor slides, Cloudflare as carrying about 20% of internet traffic, and Sentry as serving four million developers. These are adoption or reach figures, not breach counts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Tenet extrapolated from public artifacts and those adoption estimates to more than 15,000 potentially exposed organizations. The number represents vulnerable setup adoption, not confirmed incidents. No verified figure establishes how many GhostJacking attacks have occurred worldwide.
What related disclosure should defenders know about?
Tenet also reported a separate Claude Desktop sandbox-escape issue that it disclosed to Anthropic and that was fixed before the DEF CON presentation. That issue was part of the broader disclosure and is not required for the Cloudflare, Datadog or Sentry attack paths. Fixing a sandbox escape therefore does not remove the general risk of poisoned telemetry reaching an over-privileged agent.
Frequently Asked Questions
Can prompt injection work if the log platform itself is trusted?
Yes. Trust in the collector proves that the record was stored faithfully, not that every field was written by a trusted operator. The agent needs a separate provenance signal that distinguishes platform metadata from attacker-controlled values.
Should I disable all AI access to logs?
Not necessarily. Read-only, network-restricted triage can retain useful automation if high-impact tools and secrets are isolated. The unsafe design is allowing the same context to reach unrestricted execution or production changes without an external approval step.
How is GhostJacking different from ordinary phishing?
Phishing persuades a person to disclose information or take an action. GhostJacking targets the model’s interpretation of machine-collected data, then relies on the agent’s existing permissions to perform the action. A human may never see the injected text before the tool call occurs.
What evidence should an incident responder collect first?
Capture the exact telemetry value, its ingestion path, the agent’s full context, model output, tool arguments, approval records and egress logs. Preserve these before deleting the alert, because the provenance chain is needed to determine which commands and credentials were exposed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
