It was just another blocked request. A firewall turned the attacker away at the door, logged the incident, and went back to work. On the other side of that glass, an AI coding agent opened the same log file, read the text inside it, and decided it had just been given a job to do. Before anyone noticed, the company's DNS had been rewritten.
That is the story security researchers from Tenet Security walked onto the DEF CON 34 main stage to tell on August 9. They named it GhostJacking, and the name behaves like a horror movie. The firewall did not fail. It never went down. It simply stopped mattering, because the very record it created to document an attack became the attack itself.
The log that turned into an order
Here is how it unfolds. A request arrives at Cloudflare's managed ruleset and gets blocked. That blocked event is stored byte for byte, including the attacker's poisoned User-Agent header. Nothing looks unusual. It is an ordinary entry in an ordinary log, exactly the operational data an AI agent is meant to read and triage.
But the text inside that header is crafted to read like an instruction. An AI coding agent reviewing blocked events has no way to tell a directive the company actually meant to give it apart from text an attacker planted. It reads the payload as an order, grabs credentials issued months earlier, and acts.
In Tenet's benchmark, Claude Code on Sonnet 4.6 followed the planted instruction in nine out of ten attempts under Cloudflare's recommended configuration. Nine out of ten is not a corner case. It is a default behavior.
The scariest part is that nothing malfunctioned. Endpoint detection, the web application firewall, identity management, all of it stayed quiet, because every request carried a valid credential and satisfied every rule the company had written. There was simply nothing left to catch.
Tenet found public evidence of the same exposed setup at 48 organizations, including six confirmed Fortune 500 companies. The chain is not limited to Cloudflare. SecurityWeek reported the same pattern against Datadog and Sentry, where the injection surface is an alert or an error report.
Why the old fixes do not work
GhostJacking survives because it does not attack the model's reasoning. It attacks the authority the model holds. The model is not tricked into something forbidden. It is doing something it was already allowed to do.
There is no compromised admin account and no bypassed firewall. The chain only needs one condition: an agent that reads operational data and also holds write access to the systems that data describes. Every step is something the agent was already permitted to do.
The mechanism can be traced step by step. SC Media reported that the agent Tenet drove live at Cloudflare was Cursor, reading through a GraphQL integration and writing through the Cloudflare API. The agent ingests the poisoned header, patches the DNS A record, adds a CNAME, and gives the attacker a path to reroute web and email traffic. In the Datadog and Sentry version the damage compounds, because one agent's output becomes the next agent's input.
The fix is not a better prompt. Steve Wilson, Chief AI and Product Officer at Exabeam and co-lead of the OWASP Top 10 for LLM Applications, is blunt about that idea. Security rules written inside prompts may shape behavior, he argues, but they are still suggestions to the model, not enforceable security controls.
A gate outside the model
Wilson's proposed answer lives outside the model entirely. Put an authorization gate between the agent and the action it wants to take. The agent can propose an exact DNS change, but it cannot grant itself the authority to make it. That relocation moves the decision into code that either passes or fails. A safe change clears a deterministic policy check and stays autonomous. Anything ambiguous or high in blast radius routes to a named human who approves the change.
The tradeoff, Wilson acknowledges, is that the agent loses the ability to improvise arbitrary high-impact changes on its own. What it keeps is autonomous investigation and routine remediation. Reading logs, correlating alerts, and drafting timelines stay automatic. A bounded action like restarting a named service clears the policy gate. Changing DNS, altering identity privileges, deploying code, or rerouting production traffic requires a named human. Useful autonomy survives. What does not survive is the path from an attacker's text to unreviewed production authority.
The industry is not positioned to accept this quickly. Ivanti's 2026 State of Cybersecurity Report found that 77% of security professionals are comfortable letting AI act without human review, the exact posture Wilson's gate constrains.
Tenet co-founder and CEO Barak Sternberg told Dark Reading that the way in was a request the firewall had already blocked, and that the firewall never went down; it just stopped mattering. His first step is modest and free: an inventory. Every agent that reads outside data and can also write or execute belongs on a risk register, which needs no new tooling.
Yet even that baseline is rarely reached. Senior IEEE member Kayne McGladrey has argued for years that an AI deployment needs a hard governance threshold, a named human holding a kill switch, and a way to roll back. Asked whether any Fortune 500 company actually runs that, he was blunt: he has not seen it done, and no company has said it. His explanation for the delay is economic. Companies are accepting the risk, either deliberately or unconsciously, betting that the advantage outweighs the penalty. What would change behavior, he argues, is if the penalties outweighed the advantages.
GhostJacking makes that bet visible. A blocked payload reaches the agent through the system built to record blocked payloads. Once it arrives, the question is no longer whether the model recognizes an attack, but whether the model holds the authority to turn one into a production change. For most deployments today, the answer is yes.
Comments