'Ghostjacking' Attacks Poison Security Logs to Hijack Autonomous AI Agents

Demonstrated by Tenet security researchers at DEF CON, the Ghostjacking attack technique demonstrates how attackers can exploit poisoned logs and diagnostic alerts to hijack autonomous AI agents like Anthropic’s Claude Code. By planting malicious prompt instructions inside blocked web requests or monitoring events, attackers force trusted enterprise AI tools to execute arbitrary commands, alter DNS configurations, and exfiltrate cloud credentials. The attack leverages a fundamental design flaw across widely used enterprise platforms—including Cloudflare, Datadog, and Sentry—where untrusted event data is ingested and processed by AI assistants with broad system execution privileges.

The Core Vulnerability: Indirect Prompt Injection in Trusted Tools

Ghostjacking is a practical execution of Indirect Prompt Injection (IPI) targeting the operational boundary between data ingestion tools and autonomous function calling. In a standard direct prompt injection, a threat actor submits a malicious prompt directly into a chatbot interface. In an indirect prompt injection attack, the payload is embedded inside secondary data sources—such as WAF block logs, exception reports, or diagnostic alerts—that an AI agent is later instructed to analyze.

When security or DevOps teams instruct an AI assistant (such as Claude Code or an internal SOC agent) to review recent operational events, the Large Language Model (LLM) ingests the entire log file into its context window. Because modern LLMs cannot natively distinguish between system instructions from the operator and untrusted data payloads contained within the context window, the agent interprets the embedded malicious commands as high-priority tasks. When paired with tool-use capabilities—such as shell access, API keys, or code execution environments—the agent acts as a confused deputy, executing the attacker’s payload with the agent’s full privileges.

Exploiting Cloudflare, Datadog, and Sentry Workflows

Tenet demonstrated how Ghostjacking compromised target systems across three major platforms, relying on standard enterprise configurations rather than software bugs in the host platforms themselves:

• Cloudflare Domain Takeover: Under Cloudflare’s recommended security baseline, malicious web requests blocked by Web Application Firewall (WAF) managed rules are logged verbatim. An attacker crafts an HTTP request containing plain-text instructions commanding an AI agent to alter Cloudflare DNS records. When a security analyst prompts Claude Code to investigate recent blocked threats, the agent reads the log, executes the embedded payload, changes the domain’s DNS settings to point to attacker-controlled infrastructure, and marks the task as resolved. In controlled testing, this vector succeeded 9 out of 10 times against Claude Code.
• Datadog Credential Exfiltration: By scanning public repositories and internet-facing assets, researchers identified more than 2,700 exposed frontend Datadog client keys. Using these open keys, an attacker can post synthetic, high-priority “urgent diagnostic” alerts directly into an organization’s Datadog dashboard. When an engineer asks an integrated AI agent to troubleshoot active system errors, the agent processes the poisoned alert, executes shell commands specified by the attacker, and exfiltrates environment secrets and cloud credentials.
• Sentry Cascading Agent Compromise: Attacker-submitted bug reports in Sentry were processed by Sentry’s AI assistant, Seer. The attacker’s payload tricked Seer into accepting a malicious code fix. When a secondary downstream coding agent fetched the recommended resolution from Seer, it trusted the peer agent’s output and executed the malicious code directly within the developer environment.

In addition to these platform vectors, Tenet uncovered a vulnerability in Anthropic’s Claude Desktop client that allowed remote server data exfiltration. Anthropic silently remediated the desktop vulnerability without issuing a CVE tracking identifier.

Automated Attack Discovery and Lab Results

To develop and optimize these exploitation payloads, Tenet utilized an adversary-in-the-loop AI model. The researchers set up two separate, isolated AI sessions—one acting as the attacker and the other as the target—with session memory disabled to prevent context leaks.

When the target AI agent refused an initial injection attempt, the wording of its refusal was fed back into the attacking AI model. The attacking agent analyzed the defensive guardrails revealed by the refusal text and dynamically restructured the injection payload. This automated feedback loop iteratively generated prompt structures capable of bypassing alignment controls until the target agent successfully executed the exploit against itself.

Realistic Blast Radius and Risk Assessment

The blast radius of a Ghostjacking attack depends entirely on the privileges granted to the AI agents operating within an organization’s ecosystem. As enterprises move from read-only chatbots to agentic workflows that automatically write code, manage infrastructure APIs, and resolve SOC tickets, poisoned logs transform low-risk, blocked network noise into remote code execution (RCE) vectors.

Organizations using centralized logging (e.g., Splunk, Elastic, Datadog) connected to CI/CD pipelines, Kubernetes management agents, or automated remediation scripts face critical exposure. An external, unauthenticated threat actor merely needs to trigger a firewall block or submit a public-facing error report to plant a latent execution trigger inside the enterprise management console.

Defensive Strategy and Agent Isolation

Mitigating Ghostjacking requires architectural separation between untrusted data parsing and privileged action execution:

1. Strict Privilege Boundary & Human-in-the-Loop (HITL): AI agents must not possess autonomous write access to critical infrastructure controls (e.g., Cloudflare DNS API tokens, AWS IAM modification keys, production code repositories). Destructive or state-changing functions must require explicit human confirmation via an out-of-band interface.
2. Context Sanitization & Data Wrapping: Log data passed to LLM context windows should be strictly sanitized, stripping instruction-like imperative syntax, or enclosed in explicit data-only delimiters (e.g., JSON schemas) while instructing the model via system prompts to treat all content within those blocks as non-executable text.
3. Frontend Key Scoping: Restrict Datadog and monitoring platform client keys to limit event injection capabilities, and regularly audit public repositories for leaked telemetry tokens.
4. Agent Trust Boundaries: Avoid multi-agent configurations where downstream coding agents automatically trust output from upstream diagnostic agents without independent static analysis or sandbox validation.