Ghostjacking: How Attackers Are Turning AI Agents Against Their Own Companies at DEF CON 34

DEF CON 34 kicked off in Las Vegas with a security talk that should make every organization using AI agents pay close attention. Tenet Security, an Israeli cybersecurity startup, demonstrated a novel attack technique called Ghostjacking. It works by exploiting the very tools companies already trust to protect their infrastructure.

The attack is deceptively simple. An adversary plants malicious instructions as plain text in logs or alerts from platforms like Cloudflare, Datadog, and Sentry. When an AI agent such as an engineer’s Claude Code assistant is asked to review the events, it reads the attacker’s planted text and executes it as if it were a legitimate instruction. The firewall never went down. It just stopped mattering.

Tenet’s researchers demonstrated the attack against all three platforms with a 90% success rate against Claude Code on Cloudflare’s own recommended security setup. The demonstration showed how a single poisoned log entry could lead to a full domain takeover, cloud credential theft, and persistent backdoor access.

Here is how the attack works on each platform. On Cloudflare, a malicious request is blocked by the firewall and logged verbatim including the attacker’s instructions. When an analyst asks their AI assistant to review blocked events, the agent reads the log and alters the organization’s DNS settings, pointing the domain to an attacker-controlled server. The agent then reports the issue as resolved. Cloudflare routes roughly 20% of all internet traffic and is used by 42% of Fortune 500 companies.

On Datadog, which runs in nearly half of Fortune 500 organizations, the attack exploits front-end API keys that are routinely left exposed. Tenet found over 2,700 such keys exposed on the internet. With a key in hand, an attacker plants a fake diagnostic alert. When an engineer asks their AI agent to check for errors, the agent reads the alert and executes the attacker’s command, exfiltrating environment secrets and cloud credentials.

On Sentry, trusted by close to 4 million developers, the attacker uses a crafted error report. Sentry AI agent Seer reads the report and adopts a proposed fake fix as its own. When the fix is passed to a coding agent that trusts Seer, the attacker code is executed. The chain of trust becomes the chain of infection.

But the attack does not stop at a developer laptop. Tenet demonstrated a complete kill chain: initial access through a poisoned log, escalation from a developer workstation to core infrastructure, exfiltration of stolen data through a Claude Desktop sandbox escape zero-day, and persistence through backdoors planted in the agent memory and configuration. The sandbox vulnerability was reported to Anthropic, confirmed, and fixed before the talk.

Tenet estimates that 15,000 or more organizations are exposed through the Cloudflare vector alone. The researchers identified a trillion-dollar technology company, a Fortune 500 firm, and a leading AI research lab among those running the vulnerable setup. The attack leaves no trace because every action is authorized. The AI has legitimate access to the tools it uses, so endpoint detection, web application firewalls, and identity management systems flag nothing.

This is not the first time Tenet has demonstrated this class of attack. In June, the company showed Agentjacking, where a single fake bug report could hijack AI coding assistants through Sentry. Ghostjacking extends that research significantly. It works across multiple platforms, it reaches beyond the developer machine into core infrastructure, and it jumps from one AI agent to another.

The underlying problem is structural. As Tenet puts it: An AI reads outside data it trusts, and the same AI can also act on it. Wherever those two things meet, the door is open. The issue is not specific to Cloudflare, Datadog, or Sentry. The same pattern applies to any setup where an agent reads and acts on external data.

For organizations using AI agents, the implications are clear. Any tool that feeds data into an agent and also allows the agent to take action on that data is a potential attack vector. Limiting agent permissions, implementing human-in-the-loop verification for infrastructure changes, and auditing which data sources agents trust are essential first steps. This Ghostjacking research is a reminder that AI agents are only as secure as the data they read and the tools they are allowed to control.

What makes Ghostjacking particularly dangerous is that it exploits the normal functioning of AI agents. The agent is not tricked into doing something it cannot do. It is simply reading data from a trusted source and acting on it. That is exactly what agents are designed to do. The attack succeeds because the line between trusted data and untrusted input has become invisible.

Tenet also demonstrated something unusual: they used one AI agent to devise the attack that would be carried out by another agent. Each time the target AI refused a request, its refusal revealed the wording it would accept, until it ran the attack against today.