By Your Cloudflare WAF flagged the request. Blocked it. Logged it. Then your AI coding agent read that log to debug the issue — and silently rerouted your company’s DNS to attacker infrastructure. No CVE required. No authentication bypass. Just a poisoned User-Agent header, an over-permissioned agent, and a 90% success rate. Tenet Security demonstrated this at DEF CON 34 on August 9, and called it GhostJacking.
What Is GhostJacking
GhostJacking is indirect prompt injection against tools developers already trust: Cloudflare firewall logs, Datadog monitoring alerts, Sentry error reports. Instead of attacking the model directly, an attacker embeds malicious instructions into the operational data your agent reads. The agent can’t distinguish “data to analyze” from “instructions to follow” — so it follows them, using your credentials, making legitimate API calls that no security tool flags as suspicious.
This isn’t a code flaw. There’s no CVE. The attack exploits how agents are configured, not how models are built. Anthropic can’t patch this for you.
Three Platforms, Three Attack Vectors
Cloudflare: DNS Hijack via WAF Log
The attacker triggers a request to your site that Cloudflare blocks. The User-Agent header contains a crafted “diagnostic” message — a fake finding about a DNS mismatch. Cloudflare logs it verbatim. Your agent, running with Cloudflare MCP read and write access, reviews WAF events to fix issues. It reads the injected note as a legitimate finding and patches your DNS A record accordingly. Your web and email traffic now routes to attacker infrastructure. Every API call was authorized. EDR didn’t fire. IAM didn’t fire. The WAF didn’t fire — it was the WAF’s own log.
Tenet tested this against Claude Code on the vendor-recommended configuration. It succeeded nine out of ten times.
Datadog: Credential Exfiltration via Planted Alert
Datadog’s client-side API key routinely leaks into JavaScript bundles and GitHub repos. Tenet found over 2,700 exposed keys. With a valid key, an attacker plants a fake “urgent diagnostic alert” in your monitoring stream. When your agent checks for recent errors, it reads the fake alert and executes the embedded instruction — typically exfiltrating AWS credentials or source-control tokens to an attacker-controlled endpoint. The developer sees only benign-looking diagnostic messages. Datadog runs in 48% of Fortune 500 companies.
Sentry: Cross-Agent Lateral Movement
Sentry DSNs are public by design — embedded in client-side JavaScript so browsers can report errors. Tenet found 2,388 exposed DSNs, including 71 in the Tranco top-1M. An attacker POSTs a crafted error event to Sentry’s ingest API. Sentry’s own AI assistant, Seer, reads that event and generates a “suggested fix” — which is the attacker’s instruction. When your coding agent pulls in Seer’s recommendation, it treats it as authoritative. One AI vouching for an attack to another AI. No security model accounts for this yet.
The Exposure Numbers
Cloudflare runs on 42% of Fortune 500 companies. Datadog on 48%. Sentry serves four million developers. Tenet estimates over 15,000 organizations are exposed through vulnerable Cloudflare configurations alone. None of their existing security tooling would have caught it.
The full kill chain — initial access, privilege escalation, data exfiltration, persistence via backdoor in agent configuration — runs without a single alert because every step is an authorized action by a trusted identity. The agent had permission to read logs. The agent had permission to update DNS. It did both. That’s the whole attack.
Three Things to Do Right Now
Tenet’s mitigations are architectural. There’s no prompt-engineering fix.
- Split read and write. An agent that reads logs or alerts should not also have write or execute permissions in the same session. Use separate MCP configurations for investigation tasks and modification tasks.
- Require human approval for all writes. Any action that modifies infrastructure — DNS, cloud config, credentials — needs an explicit human approval gate. The agent can propose the change. It cannot approve it.
- Block outbound by default, scope credentials per task. Agents don’t need internet access for most tasks. Limit what they can reach. Use scoped API keys with the minimum permissions needed for a specific job.
Start with an audit: every agent in your stack that reads external data and also has write or execute permissions belongs on a risk register. VentureBeat’s breakdown of the DNS fix is a useful reference for how the read/write split works in practice.
The Actual Problem
Organizations have spent decades building identity governance for humans: least privilege, separation of duties, audit trails. They’ve built almost none of it for agents. Agents inherit developer-level credentials. They read observability data, secrets, and logs — and in the same session, they act on all of it. GhostJacking is the proof of concept that this gap is exploitable at scale, with tools every developer already runs.
The fix isn’t a better model. It’s a permission map. Decide which actions are pre-approved, which require a human, and which an agent should never be able to do at all. That work belongs to you, not Anthropic.
