[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsUtbeoIwYgCTJD912r8jFk_s0FYzeF0xoqgrM9ICgvc":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"6a9d256e-9ee0-4cc7-8370-e6d682b2bbf0","‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad","ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad-b5619b","An AI agent executes instructions that an attacker has planted in the log or alert that records a blocked request word for word. The post ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad appeared first on SecurityWeek.","Tenet researchers demonstrated a 'Ghostjacking' attack where malicious instructions are planted in logs or alerts, tricking AI agents into executing them. This novel attack targets trusted platforms like Cloudflare, Datadog, and Sentry, leading to domain hijacking, code execution, and credential theft.","Ghostjacking attack uses poisoned logs to turn AI agents rogue.","DEF CON – Tenet security researchers have demonstrated a novel AI hijacking attack that relies on tools trusted by the agent to deliver malicious instructions. The Israeli cybersecurity startup, which emerged from stealth mode in June to protect organizations from rogue agents, previously demonstrated how threat actors can poison data fed to AI agents to manipulate their behavior, an action it calls ‘Agentjacking’. Dubbed Ghostjacking, the newly demonstrated attack builds on the same assumption: an external threat actor is able to plant instructions as text in logs or alerts to turn AI agents rogue. The underlying issue, it says, is spread widely, as the attack targets three highly trusted platforms: Cloudflare, which routes 20% of all web traffic, Datadog, and Sentry. Cloudflare and Datadog are used by nearly half of Fortune 500 companies each, while Sentry is trusted by close to 4 million developers. The compromised agent “hijacked the domain on Cloudflare, ran code and stole cloud credentials on Datadog, and turned one AI into an insider that vouched for the attacker to the next on Sentry,” Tenet says. Cloudflare’s recommended security configuration, the startup says, exposes organizations to one of the attack vectors: a bad request is blocked by the firewall level and logged word for word, injecting the attacker’s malicious instructions as plain text in the log.Advertisement. Scroll to continue reading. When an analyst asks an agent to review the event, the AI reads and executes the instructions, altering the organization’s DNS settings to point to an attacker-controlled domain, and then reporting the issue as resolved. “It worked 9 times out of 10 against Claude Code. Every request had already been blocked. The domain was taken over anyway. […] It is Cloudflare’s managed security rule that blocks the request, and that block is what carries the attack in,” Tenet says. Another attack vector abuses a Datadog key meant for the front end, but which is routinely left in the open, as demonstrated by the over 2,700 such keys the cybersecurity firm has found on the internet. “With that key, an attacker plants a fake ‘urgent diagnostic’ alert. When an engineer asks their AI agent to check for errors, the agent reads it and runs the attacker’s command,” Tenet notes. The attack manipulated Claude Code into executing code and exfiltrating environment secrets and cloud credentials. To target Sentry, an attacker uses a crafted report that is read by Sentry’s AI agent Seer, which adopts a proposed fake fix as its own. When the fix is passed to the coding agent that trusts Seer, the attacker’s code is executed. Tenet also says it used an AI agent to devise the attack that would be carried out by another agent. “Each time the target AI refused, its refusal revealed the wording it would accept, until it ran the attack against itself. This was a controlled lab test: two separate AI sessions, one as attacker and one as target, with memory off so neither knew about the other,” the company says. Additionally, the startup found a vulnerability in Claude Desktop that could be exploited to exfiltrate data to a remote server. Anthropic has fixed the flaw without issuing a CVE, Tenet says. “Sentry, Cloudflare, and Datadog are not three separate flaws. They are the same shape. An AI reads outside data it trusts, and the same AI can also act on it. Wherever those two things meet, the door is open. The same pattern shows up far beyond these three, in setups like Splunk with a build system, or Datadog with Kubernetes,” the company notes. Related: Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility Related: Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data Related: Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Related: Podcast: Compliance Won’t Save You: The Future of Cyber Risk with Edna Conway Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Vishing Extortion Group UNC6671 Rebrands After Making MillionsMicrosoft, Apple Release Fresh Security Updates3.8 Million Impacted by Unlimited Technology Systems Data BreachCritical Vulnerabilities Patched With Chrome 151 UpdateCritical Paperclip Flaw Allowed Admin Access, Code ExecutionBelarusian Ransom Cartel Mastermind Gets 16 Years in PrisonCisco Patches Critical SD-WAN, IOS XE, FMC VulnerabilitiesHackers Start Exploiting Recent JetBrains TeamCity Vulnerability Latest News New Jersey, Alabama Join States Targeted in Water CyberattacksMetabase Patches Vulnerability Exploited as Zero-DayNovel Private APN Pivot Let Hackers Sabotage Second Polish Energy FacilityCISA Urges Immediate Patching of Exploited Progress LoadMaster VulnerabilityCorporate Data Stolen in Levi Strauss CyberattackCritical Flaws Discovered in Belgian eID Software Used by 2 Million PeopleCritical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise DataIn Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FArtificial-intelligence-AI.jpeg","2026-08-10T12:59:34+00:00","2026-08-10T14:00:14.726957+00:00",8,[18,21,23,25,27,30],{"name":19,"type":20},"Tenet","vendor",{"name":22,"type":20},"Cloudflare",{"name":24,"type":20},"Datadog",{"name":26,"type":20},"Sentry",{"name":28,"type":29},"Claude Code","product",{"name":31,"type":29},"Seer","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60],{"type":57,"value":58,"context":59},"malware","Ghostjacking","Name of the AI hijacking attack demonstrated by Tenet.",{"type":57,"value":61,"context":62},"Agentjacking","Term used by Tenet for poisoning data fed to AI agents."]