Ghostjacking: a blocked request can still reach an AI agent
Tenet's research shows how attacker-controlled log content can steer an agent. Reading an event should not give that event authority to change systems.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
Blocking a malicious request does not remove it from every system. If the request is recorded in a log, an AI assistant may encounter its contents later while investigating the incident.
Tenet Security’s Ghostjacking research demonstrates attacks through observability and security tools, including Cloudflare, Datadog and Sentry. The common issue is an agent treating attacker-controlled material as a reason to use its own legitimate permissions.
The log has two authors
A platform may produce the event record, but an external party may control fields inside it. A trusted service returning a log does not make the request text inside that log trustworthy.
That distinction can disappear when one assistant summarises an event for another. The second assistant sees a recommendation rather than the original input. It still needs to know where the recommendation came from and what evidence supports it.
We recommend keeping the origin of externally supplied content visible throughout the workflow. More importantly, access controls should limit what the investigating agent can change.
Separate investigation from authority
An assistant reading an alert does not necessarily need permission to edit DNS, install a package or modify production. Give it the capabilities needed to investigate and require a separate decision for consequential changes.
The approval should show the proposed action, its target and its reason. Approving a vague instruction to “fix the issue” offers little protection if the issue description itself has been manipulated.
Include this path in an authorised test: place harmless instruction-like content in a test event and check whether the assistant treats it as evidence or as a command. Examine the tool calls, not just the final explanation.
A firewall can correctly block the original traffic while a later workflow handles the logged content badly. Assess both boundaries. Neither the presence of a security product nor a familiar API response establishes that the agent’s next action is appropriate.
