Quick Facts
- Tenet Security demonstrated GhostJacking at DEF CON 34 on Aug. 9, 2026, showing how a blocked firewall request can trick an AI agent into hijacking company DNS.
- Claude Code on Sonnet 4.6 followed planted malicious instructions in 9 of 10 attempts under Cloudflare’s recommended configuration.
- Tenet estimates more than 15,000 organizations are exposed, including six confirmed Fortune 500 companies.
An AI coding agent read a Cloudflare firewall log, found an attacker’s payload buried inside it, and rewrote the company’s DNS records. The firewall had already blocked the malicious request. Blocking it wrote the payload into the log. That log became the attack surface.
Researchers from Tenet Security presented this technique, called GhostJacking, on the DEF CON 34 main stage in Las Vegas on Aug. 9, 2026. Tenet CEO Barak Sternberg, CTO Nevo Poran, and researcher Ron Bobrov built the full attack chain and ran it live.
How the Attack Works
GhostJacking is a form of indirect prompt injection. An attacker embeds malicious instructions inside data the agent is likely to inspect, not in a direct command to the model. The agent cannot distinguish the attacker’s text from a legitimate instruction.
In the Cloudflare scenario, a Cursor agent ingested a poisoned User-Agent header stored in a blocked traffic log. The agent then patched the company’s DNS A record and added a CNAME entry, giving the attacker a path to reroute web and email traffic. The company’s credentials, issued months earlier, authorized every step.
Tenet demonstrated two additional attack vectors. In the Datadog scenario, researchers found more than 2,700 client tokens leaked in website page sources across the internet. An attacker plants a fake urgent diagnostic alert using such a token. When an engineer asks an AI agent to check for errors, the agent reads the fake alert and executes the attacker’s command.
The Sentry vector went further. Tenet used Sentry’s own AI, called Seer, to vouch for the attacker’s fake fix to the next agent in the chain. One AI trusted another AI’s conclusion and ran malicious code. Researchers also demonstrated a self-exploit technique in which one AI agent built an attack that a second AI agent would accept without question.
The Scale of Exposure
Cloudflare runs in 42% of Fortune 500 firms and carries roughly one-fifth of all internet traffic. Datadog runs in 48% of Fortune 500 companies. Sentry is used by four million developers. Tenet found public evidence of the exposed Cloudflare setup at 48 organizations, including a trillion-dollar global technology company, a global payments provider, and a leading AI research lab.
Traditional security tools did not flag any of it. According to Tenet, endpoint detection and response, web application firewalls, and identity and access management systems never fired during testing.
The Fix
The core problem is not model behavior. It is permissions. Sternberg was direct: “The first thing I’d do is put an authorization gate outside the model,” said Steve Wilson, Chief AI and Product Officer at Exabeam and project co-lead for the OWASP Top 10 for LLM Applications.
The proposed fix separates reading from acting. An agent can propose a DNS change. It cannot approve one. Security teams must build a permission map that defines which actions are pre-authorized and which require a human sign-off before execution.
Sternberg outlined three immediate controls: least privilege per task, short-lived credentials, and treating any token an agent can reach as already compromised. He offered one diagnostic question for executives: which of your agents reads outside data and can also write or execute? That list, he said, is your risk register.
Merritt Baer, CSO at Enkrypt AI and former Deputy CISO at AWS, identified a common gap in enterprise security reviews. “Enterprises believe they’ve approved AI vendors, but what they’ve actually approved is an interface, not the underlying system,” Baer said.
The attack required no zero-day exploit. It used approved tools, valid credentials, and normal agent behavior. The only missing control was a human in the approval loop.