GhostJacking: The AI Agent Attack Businesses Should Know

A security firm rewrote a company's DNS records using nothing but data a firewall had already blocked. No stolen password. No bypassed security tool. Just an AI coding agent doing exactly what it was built to do, reading a log file and acting on what it found.

The technique is called GhostJacking, and Tenet Security demonstrated it on the main stage at DEF CON 34 on August 9, 2026. It matters for growing businesses because the tools involved, AI coding assistants with access to production systems, are showing up in more IT environments every month, often with far more access than anyone signed off on.

How the Attack Actually Works

Here is the chain. An attacker sends a request with a malicious instruction hidden inside it, aimed at Cloudflare's managed ruleset. Cloudflare's firewall does its job and blocks the request. But blocking it does not delete it. The request gets logged byte for byte, poisoned instruction included.

Later, an AI coding agent reviewing those blocked events for troubleshooting reads the attacker's text and cannot tell it apart from a legitimate instruction. In Tenet's demonstration, the agent was Cursor, reading the logs through a GraphQL integration and writing changes through the Cloudflare API. It patched a DNS A record and added a CNAME, rerouting the company's web and email traffic to the attacker.

Tenet ran the same chain against Claude Code on Sonnet 4.6 separately. The agent followed the planted instruction in nine of ten attempts, under Cloudflare's own recommended configuration.

Nothing in that chain broke a rule. The firewall worked correctly. Endpoint protection stayed quiet. Identity management never flagged anything, because every API call carried a credential the company had legitimately issued months earlier. That is the uncomfortable part. A high block rate on prompt injection attempts does not mean the environment is safe, because the block itself became the delivery mechanism.

This Is Not an Isolated Case

Tenet found public evidence of the same exposed setup at 48 organizations, including six confirmed Fortune 500 companies. SecurityWeek separately reported the identical attack chain against Datadog and Sentry, where the injection surface was an error report instead of a firewall log.

The Sentry case adds a layer worth sitting with. A coding agent escalated a suspicious report to Sentry's own AI assistant, Seer, for analysis. Seer had already absorbed the attacker's proposed "fix" and returned it as its own recommendation. The coding agent followed Sentry's explicit written guidance never to act on instructions found in event data, and it still got compromised, because it trusted a conclusion from another AI system instead of the raw text. An authorization check built around one model's output inherits every injection that model already swallowed.

What Growing Businesses Should Actually Do

Steve Wilson, Chief AI and Product Officer at Exabeam and a project co-lead for the OWASP Top 10 for LLM Applications, told VentureBeat the fix is not smarter prompting. "The agent can propose the exact DNS change, but it cannot grant itself the authority to make it," he said. His recommendation is a permission model that sits outside the AI model entirely: a coding agent can read logs, investigate, and draft a fix on its own, but anything that changes DNS, alters identity permissions, deploys code, or reroutes production traffic needs a named human to approve it.

Barak Sternberg, Tenet's co-founder and CEO, made a similar point to Dark Reading. The firewall in this attack never actually failed, it just stopped being relevant once the agent had legitimate write access and no boundary on what it could do with it. His starting recommendation is an inventory: every AI agent that reads outside data and can also write to or execute changes on production systems belongs on a risk register, today, before an incident forces the question.

For a 40 to 150 person company, this rarely shows up as a headline security event. It shows up as a developer or an IT contractor connecting Cursor, Claude Code, or a similar coding assistant to a cloud account for convenience, then giving it broad API access to move faster. Nobody sits down and asks what that agent can touch if the wrong text ends up in a log it reads. That gap, not the AI model itself, is what GhostJacking exploits.

Where This Fits Into Managed IT

This is exactly the kind of risk that gets missed without someone whose job is to ask the boring questions before a tool gets deployed. Which systems can an AI agent read from. Which systems can it write to. Does a DNS change, a permission change, or a code deployment ever happen without a person in the loop. Those questions do not get answered by installing better software. They get answered by someone reviewing the actual permission map, the same way a managed IT partner already reviews firewall rules, admin accounts, and vendor access today.

If your business has AI coding tools or agents connected to production infrastructure right now, an audit of what they can actually do, not what they were assumed to do, is worth doing this quarter rather than after something breaks.

FAQ

What is GhostJacking?

GhostJacking is a prompt injection technique, publicly demonstrated by Tenet Security at DEF CON 34 in August 2026, where an AI coding agent reads an attacker's instruction out of logged data, such as a blocked firewall request or an error report, and executes it using credentials the agent already legitimately holds.

Is this specific to one AI tool like Cursor or Claude Code?

No. Tenet demonstrated the attack live using Cursor and separately confirmed the same behavior in Claude Code on Sonnet 4.6, which followed the planted instruction in nine of ten test runs. The vulnerability is architectural, tied to any agent that can read attacker-reachable data and independently execute high-impact changes, not to one specific model or product.

How would a business know if it is exposed to this kind of risk?

Start with an inventory of every AI agent or coding assistant connected to production systems, and note which ones can both read external or logged data and write changes without a human approving the action first. If that combination exists anywhere, it is a candidate for tighter permissions.

Does this mean businesses should stop using AI coding agents?

No. The fix experts recommend is not removing the tools, it is separating what an agent can propose from what it can execute on its own. Reading logs, investigating alerts, and drafting a fix can stay automated. Changes to DNS, identity permissions, or production infrastructure should route to a person for approval.

Related reading: When AI Agents Go Rogue: What Growing Businesses Need to Know, AI Prompt Injection: What Your Business Needs to Know, How to Write an AI Policy for Your Business