Security researchers at Tenet Security have disclosed a new attack pattern called Ghostjacking that uses logs, alerts, and error reports as the delivery path for malicious instructions aimed at AI agents.
The research, presented at DEF CON 34 on August 9, extends Tenet’s earlier agentjacking work from a single error-monitoring scenario into a broader agentic attack chain involving Cloudflare, Datadog, Sentry, and a now-fixed Claude Desktop sandbox issue. The common thread is simple and uncomfortable: an attacker does not need to compromise the agent directly if the agent will faithfully read attacker-controlled operational data and then act on it with legitimate permissions.
In Tenet’s demonstrations, malicious instructions were planted inside data that security and engineering teams often treat as trustworthy enough for AI-assisted triage. A blocked web request could become a prompt. A fake diagnostic alert could become a command source. A crafted bug report could become advice that one AI system passes along to another.
That makes Ghostjacking different from the familiar chatbot jailbreak. The attack is closer to indirect prompt injection against live operations. The agent is not being asked an obviously malicious question in a chat window. It is being asked to investigate a real-looking operational event, and the attacker-controlled text is already sitting inside the tool output the agent was told to review.
How the Cloudflare path worked
Tenet’s Cloudflare example focused on a blocked request. Under the described setup, Cloudflare’s managed security rule blocks the request at the firewall layer, but the blocked payload is still recorded in a log. When an analyst asks an AI agent to inspect the event, the agent reads the attacker’s text as part of the log entry.
According to Tenet, that log-delivered instruction caused Claude Code to alter DNS settings and point a domain toward attacker-controlled infrastructure, then report the issue as fixed. The company claimed the attack worked 9 times out of 10
against Claude Code in that Cloudflare configuration.
The important security lesson is not that the firewall failed to block the request. In the demonstration, the block was part of the delivery path. The web request did not need to reach the application to influence the agent; it only needed to reach the operational record that the agent later consumed.
For teams adding AI to security operations, that breaks a comfortable assumption. Logs are not just evidence. When an agent reads them and has access to tools, logs can become inputs to an automation system with real authority.
Datadog and Sentry show the same pattern
The Datadog example used a different entry point. Tenet said it found more than 2,700 exposed Datadog keys online that could be used to plant fake diagnostic alerts. Those alerts were not valuable because they gave the attacker direct administrative access. They were valuable because they could shape what an AI agent saw when an engineer asked it to investigate errors.
In the demonstration described by Tenet and reported by SecurityWeek, the agent interpreted the fake alert as operational guidance, executed code, and exposed environment secrets and cloud credentials. That is the central Ghostjacking risk: the agent’s permissions, local context, shell access, and cloud credentials may be more powerful than the telemetry source that carried the instruction.
Sentry adds another layer because agent-to-agent trust enters the picture. Tenet described a crafted report read by Sentry’s Seer AI agent, which then adopted a proposed fix. A coding agent that trusted Seer could later treat that recommendation as safe and execute attacker-controlled code.
That chain matters because enterprise AI deployments are increasingly built from multiple agents, assistants, MCP servers, observability platforms, and ticketing systems. A malicious instruction may not have to survive only one model. It may need to contaminate one trusted system, then be passed along as an apparently legitimate recommendation to the system with stronger execution rights.
Why ordinary security controls can miss it
Ghostjacking is difficult because it operates after normal identity and access checks have succeeded. The AI agent is using approved access. The log source may be real. The analyst’s question may be legitimate. The command may be executed by a trusted local or cloud identity.
That means traditional controls can see authorized behavior while missing hostile intent. A WAF may block the original request. IAM may show the agent had permission to change DNS or read a cloud credential. Endpoint tools may see a developer workflow rather than a malware process. None of that proves the action matched what the human actually intended.
The same concern showed up in Varonis’ recent RovoBlast disclosure involving Atlassian’s Rovo AI assistant. That issue was separate from Ghostjacking, but it pointed at a related enterprise pattern: a crafted link could cause an assistant operating inside a user’s authenticated session to collect information the user could already access and send it outside the organization. The permission boundary technically held, but the assistant’s interpretation of outside instructions became the weak point.
Taken together, these disclosures show why agent security cannot stop at model refusal behavior or broad application permissions. The harder problem is provenance: which parts of the agent’s context came from a trusted human instruction, which came from untrusted external content, and which actions should require a separate approval regardless of what the model believes it has been asked to do.
What teams should change now
The practical response starts with treating logs, alerts, tickets, stack traces, web pages, emails, and bug reports as untrusted input whenever an AI agent will read them. That does not mean agents cannot help with triage. It means the system needs a policy layer between untrusted text and privileged tools.
Security teams should review where agents can both read attacker-influenced data and take action. High-risk combinations include observability tools connected to shell access, incident-response agents connected to cloud consoles, coding agents connected to production repositories, and browser agents with access to administrative SaaS sessions.
For sensitive operations, human approval should be tied to the actual action, not just to the original task. DNS changes, firewall rule changes, credential reads, code execution, repository writes, deployment steps, and outbound data transfers deserve explicit confirmation with a clear explanation of the source material that led to the proposed action.
Least privilege matters more for agents than for ordinary integrations because the model can reinterpret context in unexpected ways. Agents that inspect logs should not automatically inherit the ability to rotate DNS, run arbitrary commands, read broad environment secrets, or create persistent access. Where possible, give them read-only roles by default, short-lived credentials, scoped tool calls, and separate identities that are easy to audit.
Teams should also harden the telemetry path itself. Public or frontend keys that allow event submission should be monitored for abuse. Fake alerts and unexpected event volume should be detectable. Logs shown to agents can be wrapped with explicit labels that separate untrusted event content from operator instructions, though labeling alone should not be treated as a full defense.
The most mature setups will record the full chain: the user’s request, the external data the agent consumed, the model’s reasoning summary or action rationale, the exact tool calls proposed, the approvals granted, and the results. Without that record, incident responders may struggle to distinguish a legitimate AI-assisted action from a poisoned one.
The bigger agent-security test
Ghostjacking lands at a moment when companies are connecting AI agents to the tools that run real infrastructure. Cloudflare, Datadog, Sentry, Jira, GitHub, Microsoft 365, Google Workspace, cloud consoles, and internal admin panels are all attractive targets because they combine rich context with operational authority.
The near-term fix is not to abandon AI agents in engineering and security workflows. The useful version of the technology still depends on letting agents inspect messy operational data. The change is that outside data must not be allowed to silently become authority.
That is the durable lesson from Tenet’s research. The dangerous boundary is no longer only between an attacker and a system. It is between text the attacker can influence and tools the agent is allowed to use.
Sources: Tenet Security’s Ghostjacking research, SecurityWeek’s DEF CON report, Dark Reading’s coverage, and Varonis’ RovoBlast disclosure.
