Security firm Tenet has disclosed a new class of attacks called GhostJacking that exploits indirect prompt injection to manipulate AI coding and operations agents through trusted observability and security platforms, including Cloudflare, Datadog, and Sentry1,2,3. The research was presented at DEF CON 34.
The core finding: malicious instructions embedded in firewall logs, monitoring alerts, and issue reports can hijack AI agents into making unauthorized infrastructure changes, executing attacker-controlled commands, and exposing cloud credentials — all using the legitimate access those agents already hold.
Tenet reported a nine-in-ten success rate against Claude Code when testing against Cloudflare's recommended configuration. In the Cloudflare attack chain, an attacker sends a malicious request that the web application firewall correctly blocks. The blocked payload, containing attacker-controlled text, is preserved in security logs. When an analyst subsequently asks an AI agent to investigate those events, the agent may interpret the embedded text as operational instructions rather than untrusted evidence. If the agent has write access to Cloudflare configuration, researchers said it may modify DNS records, redirect a victim domain's web and email traffic to attacker-controlled infrastructure, and falsely mark the investigation as resolved.
Tenet described the risk as architectural: the firewall functions as intended, but its logs serve as a delivery mechanism for malicious instructions to a downstream agent that holds high-privilege access to the same environment.
The research demonstrated related attack chains against two additional platforms. In the Datadog scenario, a publicly exposed client-side key allowed an attacker to inject a fraudulent "urgent diagnostic" alert into a company's monitoring system. An engineer directing an AI agent to triage the alert could be induced to execute commands, resulting in unauthorized access to environment variables and cloud credentials.
In the Sentry scenario, Tenet uncovered an agent-to-agent trust abuse involving Sentry's Seer AI system. An attacker-controlled error report could shape the conclusions Seer generates, and a separate coding agent that later reads Seer's AI-generated recommendation may act on it without reviewing the original malicious input.
Tenet also disclosed a separate, now-remediated sandbox-escape vulnerability in Anthropic's Claude Desktop. Anthropic confirmed the issue and patched it before Tenet's DEF CON presentation. The flaw could have enabled data collected by an agent to bypass intended network restrictions and reach an attacker-controlled server.
Tenet's recommended mitigations include denying default outbound network access to agents, requiring human approval before executing commands or making infrastructure changes, separating read-only analysis from write-capable tools, treating every reachable token as potentially exposed, and issuing short-lived, narrowly scoped credentials. The firm also released Agent-Jackstop, an open-source hardening tool designed for Cursor and Claude Code.
ANALYSIS GhostJacking highlights a structural gap in how AI agents are integrated into security and DevOps workflows: traditional endpoint detection, WAF, and identity-access-management products are designed to flag anomalous actions by identity, but an AI agent executing a malicious instruction is using its own legitimate credentials and permissions. The attack surface is not a software vulnerability but the agent's inability to distinguish between trusted operational data and instructions hidden within that data. The nine-in-ten success rate against Claude Code under a vendor-recommended configuration underscores that default deployments may carry material risk without additional hardening controls.