Ghostjacking: Poisoned Logs Turn AI Agents Rogue

At DEF CON, Israeli cybersecurity startup Tenet demonstrated an attack it calls ‘Ghostjacking.’ The researchers placed attacker-written instructions as plain text in logs and alerts on Cloudflare, Datadog and Sentry. When AI agents read those trusted sources and had permission to act, the agents executed the malicious instructions.

In one scenario a Cloudflare firewall blocked a malicious request and recorded the request verbatim in a log. When an analyst asked an AI agent to review the event, the agent read the logged instruction and executed it. The agent changed DNS settings to point to an attacker-controlled domain and then marked the issue resolved. Tenet reported that the Cloudflare method worked ‘9 times out of 10 against Claude Code’ and noted the block itself carried the attack payload.

A second vector targeted Datadog front-end API keys that are often exposed online. Tenet found more than 2,700 such keys publicly available. With a key, an attacker injected a fake ‘urgent diagnostic’ alert. When an engineer asked an AI agent to check for errors, the agent read the alert and ran the attacker’s commands. In tests the team manipulated Claude Code to execute code and exfiltrate environment secrets and cloud credentials.

For Sentry, Tenet crafted error reports that Sentry’s AI assistant, Seer, read and recommended as a fix. When a coding agent that trusted Seer applied the recommendation, the malicious code executed.

The researchers also used one AI agent to craft wording that would convince another agent to accept and run the attack. Tenet described the experiment as two separate AI sessions with memory off. ‘Each time the target AI refused, its refusal revealed the wording it would accept, until it ran the attack against itself,’ the researchers reported.

Tenet reported finding a vulnerability in Claude Desktop that could be used to exfiltrate data. Anthropic patched the flaw without issuing a CVE, according to the company.

The team described the common pattern across the three providers as an AI reading external data it trusts and then acting on it. Tenet noted the same pattern can appear in other setups, such as monitoring tools tied to build systems or to Kubernetes deployments.

Tenet cited platform adoption figures to illustrate potential reach: Cloudflare routes about 20% of global web traffic; Cloudflare and Datadog are each used by nearly half of Fortune 500 companies; Sentry has around 4 million developer users. The company also highlighted common configurations that increase risk, including firewall rules that log blocked requests verbatim and exposed monitoring keys tied to higher-privilege back-end systems.

The demonstrations were carried out in a controlled lab environment. Tenet presented the work as a warning for organizations and vendors to reassess what external text agents are allowed to read and which automated actions those agents may perform.