By ByteBot
At DEF CON 34 last Saturday, Tenet Security put a slide on screen that should make every developer uncomfortable: the request their own Cloudflare firewall blocked was the thing that took over their AI agent. Not malware. Not a stolen credential. The firewall log itself. That attack class is called Ghostjacking, and if you use Claude Code, Cursor, GitHub Copilot, or any AI coding assistant with MCP integrations, it works against you right now.
What Ghostjacking Actually Does
Ghostjacking is indirect prompt injection at infrastructure scale. Instead of sending a malicious command directly to your AI agent, an attacker embeds instructions inside data the agent reads as trusted context — error logs, monitoring alerts, firewall records, bug reports. When you ask your agent to “check the Sentry errors” or “look at these Cloudflare logs and see what’s happening,” the agent reads attacker-controlled text and treats it as a directive. Then it acts.
The attack succeeds 90% of the time against Claude Code under Cloudflare’s default recommended configuration. Tenet demonstrated three working vectors.
Three Ways In
Cloudflare
Cloudflare logs blocked requests verbatim — User-Agent, headers, body. An attacker sends a request that will get blocked by the WAF, but poisons the User-Agent or body with prompt injection disguised as scanner telemetry. The firewall does its job and logs the entry. Later, you ask your agent to investigate the Cloudflare activity. The agent reads the log, encounters the injected instruction, and executes it. Tenet demonstrated a full DNS and email routing takeover through this path. Cloudflare is used by roughly half of Fortune 500 companies.
Datadog
Datadog’s client-side keys can be exposed in frontend code — a common misconfiguration. Anyone with that key can submit crafted diagnostic events. When an engineer directs an AI agent to investigate an alert, the agent processes the attacker’s payload and runs whatever command is embedded in it. The outcome: cloud credentials exfiltrated through a workflow that looks completely normal from every monitoring system’s perspective.
Sentry
This one is more subtle. An attacker corrupts a Sentry error report with injected content. Sentry’s own Seer AI analyzes the error and incorporates the attacker’s framing into its recommendation. A coding agent then consults Seer’s output as authoritative guidance — never reviewing the original malicious input. One AI validates the attacker’s instructions to another AI. Sentry serves four million developers.
Why Your Security Stack Won’t Catch This
The agent has valid tokens. It’s performing actions it’s authorized to perform. No malware was deployed, no authentication was bypassed, no exploit code ran. Endpoint detection sees nothing. The WAF isn’t triggered. IAM doesn’t fire because the agent IS the authorized party. The attack runs entirely on sanctioned actions through approved tools.
The insight Tenet put on stage deserves to be repeated: your security controls aren’t just failing to stop this attack — they’re actively enabling it. The firewall’s job is to block and log bad requests. It does that. The log is the weapon.
Tenet also disclosed a now-fixed zero-day in Claude Desktop that let stolen data escape the agent sandbox. Anthropic confirmed and patched it. But the broader pattern — agents reading external data from trusted platforms and treating it as instruction — remains an open architectural problem across every tool in this category.
What to Do Now
Tenet’s three immediate mitigations are the right starting point:
- Block outbound network access by default. AI agents shouldn’t reach arbitrary external endpoints. If your agent doesn’t need to call an external API, it shouldn’t be able to.
- Require human approval before any agent executes a command. Not “approve in principle at session start” — approve each action before it runs. Tedious? Yes. Required right now? Also yes.
- Separate data from instructions. An agent reviewing logs should not be able to execute what it finds in those logs without an explicit, separate confirmation step.
Beyond those three: audit your MCP server integrations and treat every data source they expose as potentially hostile. Scope your API keys so agents cannot touch DNS records, email routing, or infrastructure write operations unless those specific actions are required. If you’re running log review tasks, isolate the agent from your production network.
This Isn’t a Configuration Problem
The most important thing Ghostjacking reveals isn’t a specific attack path — it’s that the trust model underlying AI coding agents is architecturally unsound. These agents were designed to be helpful with everything in your development environment. That means they treat monitoring platforms, error trackers, and security tools as trusted. The attack surface is the helpfulness itself.
The casual workflow of “ask your agent to debug this error” is now a viable attack vector against millions of developers. Ghostjacking doesn’t need you to click a phishing link. It just needs you to do your job.
