Ghostjacking: attackers hide commands in the logs your AI agents read

Ghostjacking is prompt injection with a new delivery route: the security logs your AI agents already trust. At DEF CON on August 9 the Israeli startup Tenet Security demonstrated it live, and it worked in 9 of 10 runs against Claude Code.

Here is the shape of it. An AI agent investigating an incident reads a blocked request, an error report, or an alert. The attacker has planted instructions inside that record. The agent cannot separate data it was asked to review from a command it should run, so it runs the command. Tenet showed three routes. In Cloudflare, a blocked request logged word for word steered an agent into rewriting DNS toward an attacker domain. In Datadog, more than 2,700 exposed API keys let attackers plant fake alerts an agent would act on. In Sentry, a crafted error report reached Seer, Sentry’s own AI, which then endorsed the malicious fix for a downstream coding agent to apply.

The uncomfortable part is that every step is authorized activity. No exploit, no malware, no bypassed control. Your firewall did its job and logged the request. Your agent did its job and read the log. EDR, WAF and VPN stay quiet because nothing is technically wrong. So I would not sit and wait for a detection signature on this one.

Treat any agent that reads external data and can also act as a live attack surface. Tenet’s rule is the one to write on the whiteboard: data an agent reads must never become instructions it executes. If you run Claude Code, Cursor or Codex against production logs, ticket queues or observability tools, you carry this exposure today. Tenet measured an 85% malicious-code-execution rate across those three agents in its tests.

Do three things this week. Turn off outbound network access for agents by default, and open it per task. Require human approval before an agent runs a command, not after it already ran. And rotate the observability API keys you have left exposed, starting with Datadog, where the raw key count tells you how common the slip is. Keep the tooling current too: Anthropic has already patched a separate Claude Desktop data-exfiltration flaw Tenet reported, issued without a CVE. When we run Shadow AI monitoring with Falcon AIDR, the signal we watch is outbound LLM traffic from managed endpoints, which is where this behaviour surfaces first.

This is the same lesson as the OpenAI lab breach we covered in July, moved one layer closer to your own stack. An agent with read access to the wrong place, and permission to act on what it reads, is an intrusion waiting for someone to write the right log line. We treat that as core AI security work.

Talk to me if you want our read on where your agents read from, and what they can do next.

Drafted with AI assistance, reviewed and edited by Kenny Le and the FM CyberSecurity editorial team.

Sources

• Tenet Security, “Ghostjacking and the agentic kill chain,” tenetsecurity.ai, August 2026
• SecurityWeek, “‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad,” August 10, 2026
• DEF CON 34, Tenet Security presentation, August 9, 2026