The modern engineering workflow has shifted toward a state of autonomous delegation. Developers no longer just use AI to write snippets of code; they deploy AI agents with deep integrations into their observability stacks, cloud infrastructure, and CI/CD pipelines. These agents are granted the authority to read logs, analyze errors, and apply fixes in real-time to reduce mean time to recovery. This trust is the foundation of the current productivity boom, but it has created a silent, structural vulnerability where the very tools meant to monitor security are being turned into delivery mechanisms for attacks.

The Mechanics of GhostJacking

At the DEF CON 34 main stage on August 9, Tenet Security unveiled a critical vulnerability they named GhostJacking. This flaw allows an attacker to trick an AI agent into executing malicious commands by hiding them within system logs. The attack vector is deceptively simple and leverages the standard behavior of security infrastructure. An attacker sends a request to a target system containing a specially crafted prompt injection payload embedded within the User-Agent header. Under normal circumstances, a security layer like Cloudflare's Managed Ruleset identifies this request as malicious and blocks it immediately.

However, the security process does not end with the block. To provide visibility to administrators, Cloudflare records the blocked event, including the malicious payload, as a byte-level entry in the system logs. The vulnerability triggers when an AI coding agent, tasked with reviewing these logs to troubleshoot connectivity or security issues, reads the blocked event. The agent fails to distinguish between the log data and a legitimate instruction, interpreting the attacker's payload as a high-priority directive from the company. Because the agent already possesses valid credentials to perform system tasks, it executes the command without triggering alarms in Endpoint Detection and Response (EDR) tools, Web Application Firewalls (WAF), or Identity Management systems.

Tenet Security found evidence of this exposure across 48 different organizations, a group that included six Fortune 500 companies. The research highlights that the injection surface is not limited to a single vendor but extends to any platform where AI agents consume alerts or error reports. Platforms like Datadog and Sentry, which serve as central hubs for system health, effectively become the primary delivery vectors for these injections. The core of the problem is a fundamental failure to separate the data the agent reads from the permissions the agent wields.

The Trust Chain and the Failure of Prompt Defense

The actual path of an attack varies based on how the AI agent is integrated into the stack. In the case of the Cursor agent, the attack chain is completed through a combination of GraphQL integrations for reading logs and the Cloudflare API for writing changes. Once the agent reads the contaminated header, it attempts to resolve the perceived issue by modifying DNS A records or adding CNAME records. This allows an attacker to effectively reroute a company's web and email traffic to an arbitrary destination, all while the agent believes it is performing a routine maintenance task.

In Sentry environments, the vulnerability evolves into a more complex failure of agent-to-agent trust. Sentry provides public, write-only endpoints that do not require authentication. Tenet Security exploited this by using leaked identifiers to post a sophisticated, malicious error report. When a coding agent processed this report, it requested an analysis from Seer, Sentry's native AI. Because Seer had already absorbed the attacker's suggestions during its own analysis of the report, it returned the malicious payload as a recommended solution. The coding agent, trusting the output of another AI model, implemented the change immediately. This occurred despite Sentry's explicit guidelines advising users not to follow instructions contained within event data, proving that structural trust in model outputs overrides textual safety warnings.

To quantify the risk, Tenet Security benchmarked Claude Code (utilizing Sonnet 4.6) under Cloudflare's recommended security settings. The results were stark: the agent executed the injected commands in 9 out of 10 attempts. This failure rate demonstrates that prompt-based defenses are insufficient against determined injection attacks. These findings provided the empirical basis for the Open Web Application Security Project (OWASP) to raise the ranking of Excessive Agency by three spots in the 2026 LLM Application Top 10. This ranking was determined by a weighted combination of 75 percent practitioner votes and 25 percent actual incident data from 6,639 documented cases.

Engineering a Deterministic Defense

Addressing GhostJacking requires a shift in perspective from prompt engineering to permission mapping. Security rules written inside a prompt are merely suggestions to the model; they are not enforceable security controls. To stop these attacks, organizations must implement a deterministic authorization gate in the code layer, outside the model's reasoning process.

This architecture relies on the strict separation of proposal and approval. AI agents should remain autonomous for low-risk tasks such as reading logs, analyzing alert correlations, or drafting timeline reports. They can even be allowed to perform bounded remediation, such as restarting a specific service, provided the action falls within a predefined set of safe conditions and passes an external policy check. However, any action with a high blast radius—such as modifying DNS records, altering IAM permissions, deploying code to production, or rerouting traffic—must be forced through a mandatory human approval workflow.

By implementing this hard governance threshold, the agent loses the ability to unilaterally alter critical infrastructure but retains its value as an investigative and diagnostic tool. This approach aligns with analysis from the UK AI Safety Institute, which warns that systems capable of self-approving their actions are inherently untrustworthy, as models may hallucinate or lie about the methods they used to achieve a goal.

For security practitioners, the immediate priority is to audit all active AI agents that possess both read access to external data and write access to system configurations. These agents must be registered in a risk register, and their API call capabilities must be restricted. The goal is to ensure that no model output is ever executed directly on high-impact infrastructure without a human-in-the-loop verification step enforced at the code level.