GhostJacking Technique Exploits Identity Governance Gaps in AI Agents

Security researchers have revealed a novel attack technique termed GhostJacking, which targets identity governance gaps in AI agents by manipulating defensive telemetry inputs. As enterprises rapidly integrate autonomous AI agents to parse security alerts, triage system logs, and execute automated response tasks, threat actors are actively leveraging routine security feeds into indirect prompt injection vectors.

How GhostJacking Manipulates AI Agents

The core vulnerability relies on how AI agents process unstructured text within security alerts and blocked event logs. In a GhostJacking attack, an adversary intentionally generates a security event or blocked request that contains crafted prompt instructions—such as embedding commands within a malformed User-Agent header, a failed login username, or a blocked URL parameter.

When the defensive AI agent ingests these security alerts to analyze the threat or automate incident response, it parses the payload within its execution context. Because current architecture often fails to enforce strict boundaries between administrative instructions and ingested data, the agent interprets the log payload as direct instructions. The attacker effectively hijacks the agent’s control flow, directing it to execute unintended commands under the agent’s active operational session.

Blast Radius and Identity Governance Gaps

GhostJacking highlights significant identity governance gaps in AI agents, specifically surrounding non-human identity (NHI) privileges and service account delegation. Organizations frequently assign AI agents high-level API tokens, broad enterprise privileges, or direct write access to security orchestration tools to enable automated remediation.

The potential blast radius of a successful GhostJacking campaign depends on the victim agent’s identity scopes:

• Unauthorized Escalation: Hijacked agents can be commanded to modify security rules, create backdoor user accounts, or approve high-risk operational requests.
• Data Exfiltration: Attackers can command the agent to summarize and send sensitive telemetry, credential material, or confidential context data to attacker-controlled endpoints.
• Security Control Evasion: By controlling the agent handling security alerts, attackers can instruct the agent to suppress notifications or mark malicious activity as benign.

Mitigating GhostJacking Exposure

Defending against telemetry-based manipulation requires treating all security alerts, system logs, and event streams as untrusted input. Security teams deploying AI agents must restrict agent permissions using strict least-privilege principles, isolate read-only analysis functions from execution tools, and sanitize telemetry fields before injecting them into an agent’s context window.