GhostJacking: Hijacking AI Agents Through Authorized Actions (DEFCON 34)

What happened

GhostJacking is an attack class presented by Tenet Security at DEFCON 34 on August 9, 2026. Its defining property, in the researchers' own framing, is that the attacks run entirely on actions the AI was authorized to take - using the agent's own tools, with nothing out of behavior and no need for code execution. There is no exploit against the agent, no dropped binary, and no unusual tool call. The attacker's contribution is text placed somewhere the agent already trusts.

The delivery mechanism is what makes GhostJacking worth reading carefully. It poisons a trusted telemetry surface. An attacker sends a malicious request; a control blocks it; the block is written to an event log with the attacker's payload recorded verbatim; an engineer later asks an AI assistant to review blocked events; and the agent reads that payload as instructions it should act on. The security control that worked became the courier. Mechanically this is indirect prompt injection with a particularly cruel delivery path, and it lands on exactly the surface described in the Claude Code harness attack surface - the agent's context window as an untrusted input channel.

The agentic kill chain in four stages

Tenet frames the research as a full kill chain rather than a single trick, which is the more useful way to read it. Each stage uses authorized capability.

The escalation stage deserves particular attention because agent-to-agent trust is the least instrumented link in most deployments. We covered the same structural weakness in the Comment-and-Control multi-agent credential-theft campaign, and the trust-boundary question it raises is the subject of agent-to-agent security and trust boundaries. When one agent's output is another agent's trusted input, a single successful injection propagates without needing to re-exploit anything.

Three delivery paths, and what each one produced

Cloudflare - domain takeover. A firewall blocks an attacker's DNS-modification request and logs it verbatim. An analyst asks their AI assistant to review blocked events. The agent reads the payload as legitimate text and rewrites company DNS to point domains at attacker infrastructure. Tenet reports a 90% success rate against Claude Code, on Cloudflare's own recommended security configuration. The impact here is not data theft but control of name resolution, which sits upstream of nearly everything else.

Datadog - command execution and secret theft. Tenet reports more than 2,700 Datadog keys intended for frontend-only use left publicly exposed. Attackers use that access to plant fake "urgent diagnostic" alerts. When an engineer asks an agent to check for errors, the agent executes the attacker's commands and collects environment secrets and cloud credentials. The exposed-key half of this is a familiar failure that we treat as a first-class inventory problem in secrets management for AI agents; the novel half is that a low-value frontend key becomes a command channel once an agent is reading the platform.

Sentry - a poisoned conclusion passed down a chain. Sentry's AI, Seer, reads crafted error reports and adopts fabricated fixes as its conclusions. Downstream coding agents then trust Seer without question and execute the injected code. This is the escalation stage in miniature: the attacker never needs to reach the coding agent directly, only to convince the analysis tool the coding agent believes. The tool-description equivalent of this pattern is documented in the MCP tool-poisoning campaign, and the underlying exposure is worth checking against your own connected surface in the MCP servers developers actually use.

Tenet also documents an agent self-exploit technique - getting one model instance to iteratively refine an attack, based on the refusals it receives, until another isolated instance accepts it and executes attacker code against itself. That is a meaningful detail for anyone relying on refusal behavior as a control, and it is why we treat model-side guardrails as one layer rather than the layer.

Why GhostJacking is an agentic-endpoint risk

Tenet reports that zero standard defenses detected these attacks, and the reason is structural rather than a tuning failure. Endpoint and network controls look for malicious code, unexpected processes, and abnormal egress. GhostJacking produces none of those. The agent uses an approved tool, with approved credentials, against an approved target. What is malicious is the intent behind an otherwise ordinary call, and intent does not appear in a process tree or a netflow record.

The named victims Tenet describes - a trillion-dollar technology company, a Fortune 500 technology firm at roughly $230B, a Fortune 500 payments company, a Cloud 100 developer-tools unicorn, and a leading AI research lab - are not organizations with weak security programs. They are organizations whose security programs are pointed at the wrong layer. This is the same gap we map in the agentic AI attack surface by layer: every layer has a scanner except the agent artifacts sitting on the endpoint. It is also the practical argument for why scan-time checks and runtime governance solve different problems - a review of the agent's config at install time says nothing about what the agent reads at 3pm on Thursday.

Tenet's own hardening guidance, published as agent-jackstop, reduces to four rules: deny outbound network access by default, require human approval for agent commands, never let data an agent reads become executable instruction, and assume every accessible token is already compromised. The third is the load-bearing one, and it is an enforcement statement, not a prompting statement. A system prompt asking a model to distrust log contents is advice. A hook that evaluates the DNS-rewrite call before it executes is a control. That distinction is the whole of least privilege for AI agents.

How Anomity surfaces and governs GhostJacking

Anomity operates at the layer GhostJacking targets: the endpoint where the agent actually runs. Its lightweight, unprivileged Endpoint Sensor inventories eight AI artifact types - agents, MCP servers, skills, extensions, plugins, hooks, CLIs, and secrets - which answers the first question this research raises. Which of your agents are wired into Cloudflare, Datadog, and Sentry, what credentials do those integrations hold, and who installed them? If that inventory does not exist yet, how to build an AI agent inventory and how to build an MCP server registry are the starting points. Anomity transmits metadata only over HTTPS, never source code or prompts, with secrets redacted on the endpoint before anything leaves.

Three capabilities map onto the four kill-chain stages. On agents that expose a hook such as Claude Code's PreToolUse, runtime governance returns allow, deny, or log on each tool call before it runs - so the DNS rewrite that follows a log-review session, or the outbound request that follows a fake diagnostic alert, meets a policy decision instead of executing on trust. Behavioral baselines, as described in runtime monitoring and anomaly detection for AI agents, give the escalation stage something to trip: a session that suddenly starts touching infrastructure it has never touched is visible even when each individual call is permitted. And because every added, changed, and removed artifact lands in a queryable 90-day audit trail, the persistence stage - backdoors written into agent configuration, memory, and tool integrations - becomes a timestamped event you can query rather than a silent edit. Violations route to your SIEM, Slack, email, and Jira.

Every step in a GhostJacking chain is authorized. That is exactly why authorization alone is not a control.Anomity Threat Research

What to check across your fleet

• Enumerate every agent and MCP server connected to an observability or telemetry platform - Cloudflare, Datadog, Sentry, and peers - and record which credentials each integration holds.
• Rotate any Datadog key that was ever treated as frontend-only and is reachable publicly; Tenet reports more than 2,700 such keys exposed.
• Confirm Claude Desktop is on a build that includes the sandbox-escape fix Tenet reports as patched, and check for the same egress assumption in other desktop agent hosts.
• Treat log, alert, and error-report contents as untrusted input, not as context. Any workflow phrased as "ask the agent to review our blocked events" is a delivery path.
• Deny outbound network access by default for agents, and require approval for commands that change infrastructure state such as DNS, IAM, and firewall rules.
• Instrument agent-to-agent handoffs. A downstream agent that consumes another agent's conclusion needs the same input scepticism it would apply to a web page.
• Baseline and monitor agent configuration and memory files for modification, since Tenet's persistence stage lands there rather than in a binary.
• Assume every token an agent can reach is compromised and audit the connected-tool list against that assumption, as covered in non-human identity governance.

GhostJacking is the clearest public demonstration so far that agent permissions and agent safety are different problems. An agent doing precisely what it was allowed to do can still be the instrument of a domain takeover. This advisory is part of our prompt injection and agent hijacking coverage; if an incident like this arrives before your controls do, the AI agent incident response playbook covers the containment sequence. To see which agents across your fleet read attacker-reachable telemetry and what runtime governance would deny, book a 30-minute demo. The same property is what makes agentic payments hard to defend, since an in-mandate purchase steered by an injected instruction is authorized at every layer the network can inspect, as discussed in Europe's first live agentic payment. For the delivery technique that makes such instructions invisible to per-message filtering, see GhostSplice.