GhostJacking Attacks Let Hackers Hijack AI Agents and Steal Cloud Credentials

Security researchers have disclosed “GhostJacking,” a new class of attacks that exploits trusted observability and security platforms to manipulate AI agents into making unauthorized infrastructure changes, executing attacker-controlled commands, and exposing cloud credentials.

GhostJacking Attacks

This research, presented at DEF CON 34, describes how malicious content embedded in logs, alerts, or issue reports can serve as an indirect prompt injection against AI coding and operations agents.

Rather than exploiting traditional software vulnerabilities, this technique relies on the permissions already granted to AI assistants connected to platforms such as Cloudflare, Datadog, and Sentry.

According to Tenet, the attack chain can begin with a request that a web application firewall has already blocked. Cloudflare records blocked requests in logs, which may contain attacker-controlled text.

If an analyst subsequently asks an AI agent to investigate these events, the agent may mistakenly interpret the injected text as legitimate operational guidance.

In one demonstrated scenario, the agent was persuaded to alter DNS settings, potentially redirecting a victim organization’s web and email traffic to attacker-controlled infrastructure. Tenet reported that this approach succeeded in 9 out of 10 tests against Claude Code under a Cloudflare-recommended configuration.

The researchers argue that this poses a significant detection challenge: the firewall functions as intended, but its logs serve as a delivery mechanism for malicious instructions.

The AI agent then performs actions using valid access tokens and approved administrative tools, making it difficult for endpoint detection, IAM controls, and web application firewalls to identify the activity as malicious.

A similar technique was demonstrated against Datadog. Tenet noted that publicly exposed client-side Datadog keys can allow an attacker to submit a crafted diagnostic event.

When an engineer directs an AI agent to investigate the alert, the agent may process the attacker’s content and execute the suggested command. In the researchers’ test case, this led to unauthorized access to environment variables and cloud credentials.

The research also details agent-to-agent trust abuse involving Sentry’s Seer AI. An attacker-controlled report can influence Seer’s conclusions, after which a separate coding agent may trust the AI-generated recommendation without reviewing the original malicious input. This effectively turns one trusted AI system into an intermediary that validates an attacker’s instruction.

Tenet also disclosed a now-remediated sandbox escape in Anthropic’s Claude Desktop. The researchers reported that the flaw could have enabled data collected by an agent to bypass intended network restrictions and reach an attacker-controlled server. Anthropic confirmed and patched the issue before the DEF CON presentation.

The broader risk is not limited to a single vendor or product; GhostJacking can occur wherever an AI agent ingests untrusted external data and performs privileged actions based on it.

Monitoring systems, ticketing platforms, source-control workflows, cloud consoles, and build pipelines could all present vulnerabilities if those boundaries are not enforced.

For defenders, Tenet recommends denying default outbound network access to agents, requiring human approval before executing commands or making infrastructure changes, separating read-only analysis from write-capable tools, and treating every reachable token as potentially exposed. The company has also released Agent-Jackstop, an open-source hardening tool for Cursor and Claude Code.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world