TL;DR: At DEF CON 34 this August, researchers showed a firewall doing its job perfectly. It blocked a bad request. That block is exactly what got the company hacked.
Introduction
GhostJacking is an attack where a hacker hides instructions inside data your AI agent already trusts, like a firewall log or an error report. The agent reads the poisoned text, thinks it is a real task, and runs it with the access you gave it. Nothing looks broken because every action is technically allowed. The fix is not more passwords. It is putting a human approval gate in front of anything an agent can execute or change.
What GhostJacking actually is
GhostJacking is a hijacking method that turns your own trusted tools into the delivery route for an attack. Security firm Tenet Security demonstrated it on the DEF CON 34 main stage on August 9, 2026.
The trick is simple. An AI agent reads data from tools like firewalls, monitoring dashboards, and error trackers. An attacker plants hidden commands inside that data. The agent cannot tell the difference between real evidence and a planted instruction, so it follows the instruction using permissions it already holds.
Tenet’s research showed a 90% success rate against Claude Code when operating under Cloudflare’s recommended configuration. Worth being precise about what that number means. This is not a Claude Code flaw any more than it is a Cloudflare flaw.
It is what happens to any agent that cannot separate an instruction from data, and Tenet says as much: the risk shows up wherever an agent ingests untrusted external data and then acts with real permissions. Tenet also reported a related Claude Desktop sandbox escape to Anthropic, which confirmed and patched it before the DEF CON talk.
The scary part is what did not happen. No alarm. No broken firewall. Every action the agent took was, on its face, authorized.
A blocked request was the way in
The firewall did its job. That is exactly what handed the attacker control of the AI agent.
How the attack works, step by step
Here is the Cloudflare demo Tenet walked through on stage.
- The bait gets logged. An attacker sends a malicious web request. A web application firewall correctly blocks it, and the blocked payload is preserved in security logs.
- The agent reads the log. An analyst asks their AI agent to review the day’s blocked events. The poisoned request is sitting right there, word for word.
- The agent obeys. This is the part worth slowing down on, because the injection does not simply shout an order. It anchors itself in two things the agent can check for itself: a subdomain is genuinely missing a DMARC record, and the parent domain’s policy really is sp=reject. Both are true. Having confirmed the true parts, the agent accepts the attacker’s supplied values along with them and treats the whole thing as a real finding rather than untrusted evidence.
- The takeover happens. The assistant modifies DNS records, points the victim domain to attacker infrastructure, and falsely marks the investigation as resolved.
The block was not a failure for the attacker. The block was the delivery method.
Why your normal defenses miss it
Most security tools look for access that should not be there. GhostJacking uses access that should be there.
Ghostjacking is not a vulnerability in Cloudflare, Datadog, or Sentry. It is what happens when an AI agent with legitimate, broad access reads attacker-influenced data as part of its normal job. Because the agent is authenticated and doing an approved task, traditional EDR, WAF, and IAM products are less likely to flag an action that is valid for the agent’s identity.
The core issue is a confused deputy problem. The agent holds real power and gets tricked into using it. The problem is not unauthorized access. It is authorized access being used maliciously.
The blast radius is bigger than one tool
This is not a Cloudflare bug or a one company problem. The same pattern works anywhere an agent reads outside data and can also act.
Tenet identified at least 48 organizations running the exposed Cloudflare setup, six of them confirmed Fortune 500 companies. Its broader estimate is that more than 15,000 organizations could be exposed through vulnerable Cloudflare configurations alone.
Researchers separately found over 2,700 Datadog API keys exposed publicly, each one a potential entry point. The Datadog key in question is meant only for a website’s front end, which is exactly why it gets left in the open.
The reach is wide because the tools are everywhere. Cloudflare carries roughly a fifth of internet traffic and runs in about 42% of the Fortune 500. Datadog runs in about 48%. Sentry is used by around four million developers.
One poisoned log in Cloudflare could compromise an agent that then interacts with Datadog, which in turn affects agents monitoring Sentry alerts. One agent gets tricked, then hands the lie to the next agent. That chain reaction is what makes it dangerous.
Tenet reported every finding to the affected vendors before going public: Sentry in early June and again in July, Datadog and Cloudflare later that month, and Anthropic, which patched ahead of the talk.
How to stop GhostJacking
The research was clear about the fix. It is not a new scanner. It is control over what an agent is allowed to do on its own. Tenet even shipped an open-source tool called agent-jackstop for Cursor and Claude Code. It denies outbound network access by default, requires human approval for any command, instructs the agent to treat tool output as untrusted, and blocks credential reads at the subprocess level. The idea behind it is the whole point.
Put a human gate on any action that changes things
The strongest defense is human approval on anything an agent might execute or write, especially sensitive operations. That means no autoruns and no bypasses on shell access. An agent can propose a DNS change. A person should approve it before it ships.
Scope agents to the least access they need
Give each agent the minimum permissions it needs. Use least privilege per task, use short-lived credentials, and assume any token the agent can reach is already exposed. That shrinks what an attacker can reach.
Treat every input field as attacker controlled
Any field an outsider can influence should be treated as attacker controlled. That includes the User-Agent, the Referrer, error messages, log bodies, ticket text, and alert titles.
Keep a record of what agents read and do
At a minimum, keep immutable logs of both prompts and outputs so cause and effect stays known even when the mechanics are hard to trace.
Same poisoned log. Two very different endings.
No human ever saw it.
Attack stops here.
How Secure.com keeps its own AI Teammates safe
Secure.com runs on governed AI Teammates. They do real security work, but they do it inside the boundaries your team sets. GhostJacking is exactly the risk that the model is built to stop.
Here is how the guardrails map to this attack:
- Approval gates on consequential actions. A Teammate can investigate a blocked event and recommend a fix, but a human gives the final call to either perform that action or not.
- Scoped permissions per Teammate. Each Teammate is assigned one function, one environment, and a defined set of read, write, and execute rights, so a poisoned log cannot unlock the whole stack. Furthermore, each agent also trusts another agent’s output as untrusted to prevent and chain attack.
- A full audit trail. Every recommendation, approval, and action is logged and reviewable, so you can trace what happened and why.
- Untrusted data stays untrusted. Logs, alerts, and ticket text are treated as evidence to review, not commands to run.
- Offense tests the defense. The Red Teammate probes for gaps like this, and the findings feed straight into hardening the defensive Teammates.
Your team sets the rules. The Teammates do the work. That is the whole point of governed defense.
