GhostJacking: How Hackers Can Turn an AI Assistant Against Its Own Company

Key points

• Tenet Security demonstrated the "GhostJacking" attack method at DEF CON 34, a major annual security research conference, in August 2025.
• The technique tricks AI agents into carrying out harmful actions by hiding instructions inside routine data the agents are trusted to read, such as security logs and error reports.
• Claude Code, a popular AI coding assistant, fell for one version of the attack nine out of ten times in Tenet's tests.
• The underlying flaw is not a software bug that can be patched. It's a design problem affecting any AI agent that reads outside data and can also take action on what it reads.
• Restricting each agent to the permissions it actually needs, and requiring human approval before anything is written or executed, are the two controls researchers single out.

A cybersecurity firm called Tenet Security has demonstrated a new class of attack it calls "GhostJacking", where criminals plant hidden instructions inside the routine records an AI assistant is supposed to read, then watch as that assistant carries out those instructions using its own legitimate access.

Think of it like slipping a forged work order into a stack of real paperwork. The assistant sees a document it trusts and acts on it. Nobody breaks a lock. The door was already open.

How does the attack actually work?

AI agents are software tools that organisations deploy to watch for problems, review security alerts and take automated actions, such as adjusting network settings or deploying code fixes. They need broad access to do that job.

Tenet's researchers found that if an attacker can place text inside any record the agent reads, such as an error message, a blocked web request or a monitoring alert, that text can contain instructions the agent mistakes for a legitimate command. Our 4 August story "Poisoned AI instruction files are turning developer tools into silent data thieves" showed the same ambush working against coding assistants on GitHub, without triggering a single alarm.

In one demonstration, the team used a malicious web request that a Cloudflare firewall (a service that blocks suspicious internet traffic before it reaches a company's servers) had already stopped and logged. An analyst then asked their AI agent to review those blocked requests. The agent read the log, followed the hidden instruction inside it, and changed the company's DNS settings, the address records that tell the internet where a website lives. Controlling those settings is effectively controlling the domain. Claude Code followed that instruction nine out of ten times.

"The firewall never went down," Tenet chief executive Barak Sternberg told Dark Reading. "It just stopped mattering."

In a second test, Tenet planted a fake diagnostic alert inside Datadog, a widely used monitoring platform, prompting an agent to run attacker-controlled commands and hand over cloud account credentials. A third demonstration showed an attack jumping between two separate AI agents: a poisoned report in Sentry, a bug-tracking tool, convinced Sentry's own AI to suggest a fix, which a separate coding agent then trusted and applied.

Is there a patch for this?

No. This is not a named software flaw with a version number and a fix download. Tenet describes it as a structural problem: any AI agent that reads outside data and can also act on what it reads carries this risk by design. The researchers tested Cloudflare, Datadog and Sentry specifically, but they note the same pattern applies anywhere a monitoring tool is connected to a system that can execute commands, such as Splunk paired with a build pipeline, or Datadog connected to Kubernetes (software that manages large numbers of servers).

Platform tested	Attack method	Outcome demonstrated
Cloudflare	Poisoned firewall log	DNS settings changed; domain effectively taken over
Datadog	Fake diagnostic alert	Attacker commands executed; cloud credentials stolen
Sentry	Malicious bug report	Attack jumped from one AI agent to a second agent

What should organisations do right now?

Sternberg recommends giving each agent the smallest set of permissions it needs for a specific task, using short-lived credentials that expire quickly, and treating any data that comes from outside the organisation as potentially hostile. That includes user-agent strings (technical identifiers web browsers send to servers), error messages and log entries.

Tenet co-founder and chief technology officer Nevo Poran adds that no agent should be allowed to write or execute anything without a human approving it first, especially for sensitive operations. Automatic actions with no human checkpoint are the core of the risk.

Gene Moody, field CTO at security firm Action1, warns that once an agent starts behaving unexpectedly, tracing how it happened is extremely difficult. His minimum recommendation: keep records of every instruction an agent receives and every action it takes, stored in a format that cannot be quietly altered, so that when something goes wrong the sequence of events is recoverable even if the root cause takes time to understand.

For practitioners, the practical starting point is the question Sternberg frames in the source report: which agents on your network read outside data and can also write or execute? That list costs nothing to build and it's where the real exposure sits.

Common questions

Does this affect me if my company does not use AI agents?

Not directly. This specific attack requires an organisation to have deployed an AI agent with both read access to logs or alerts and the ability to take automated actions. If your company uses AI only as a chat assistant with no system access, the risk described here doesn't apply.

What should employees watch for?

Ask whether the AI-assisted tools your organisation uses to manage IT systems require human approval before consequential actions run. Automated approvals on by default are worth raising with whoever manages your technology.