GoKawiilNew research once again demonstrates the need strong identity governance and operational guardrails around AI agents to protect against hijacking attacks that leverage their legitimate access and privileges against their very users.
At a DEF CON 34 session this week, Tenet Security demonstrated how attackers can poison content in trusted systems such as security alerts, logs, and error reports, tricking agents into actions ranging from executing code and stealing credentials to infrastructure takeover.
"GhostJacking" the Way to Infrastructure Takeover
Tenet Security's new "GhostJacking" research builds on an earlier report in June that demonstrated how attackers could poison trusted telemetry to trick AI coding agents into executing malicious commands. The new research expands on the company's original "Agentjacking" technique with a broader attack model involving multiple trusted data sources and a wider range of potentially damaging actions.
Related:Sherlock Holmes was the “OG” Social Engineer
The attacks exploit the fact that AI agents consume data from systems such as monitoring and security platforms and can take actions based on that information. Tenet showed that attackers can plant malicious instructions in that data, which the agent can then interpret as legitimate instructions and execute using its existing permissions. The researchers demonstrated the technique through Cloudflare, Datadog, and Sentry, showing that the underlying attack pattern is not limited to any single platform.
In one demonstration, Tenet used a request that a Cloudflare firewall had blocked and recorded in its logs to trick an AI agent into modifying the company's DNS settings, effectively taking over the domain. The attack relied on the fact that AI agents can struggle to distinguish between untrusted content they are processing and instructions they are supposed to follow, making it relatively easy for an attacker to sneak malicious requests in seemingly trusted content. Claude Code fell for the trick nine out of 10 times in Tenet's study.
"A request Cloudflare's own firewall already blocked was the way in," Barak Sternberg, co-founder and CEO of Tenet, tells Dark Reading. "It gets logged word for word, an analyst asks their agent to review the blocked events, and the block delivers the attack. 90% success against Claude Code, on Cloudflare's own recommended configuration. The firewall never went down. It just stopped mattering."
In another demonstration, Tenet researchers planted a fake diagnostic alert in Datadog that prompted an agent to execute attacker controlled commands and steal environment secrets and cloud credentials. They also demonstrated how an attack could jump from one AI agent to another. For this, the researchers used a malicious Sentry report to trick Sentry's own AI into recommending an attacker-supplied fix that a separate coding agent then trusted and executed.
Related:AI Browsers Vulnerable to 'PleaseFix' Zero-Click Agent Hijacking
... continue reading