A new class of attack that turns your defenses into an intrusion vector

It is one of the most disturbing stories presented on the main stage at DEFCON 2026, on August 9 in Las Vegas. Researchers from the Israeli startup Tenet Security demonstrated that a simple fake bug report could hijack an AI agent responsible for coding or analyzing logs, using it to take control of an entire infrastructure — without firewalls detecting anything.

The technique, dubbed “GhostJacking”, relies on a dizzying paradox: it is the organization's own security tools that serve as the delivery channel for the attack. The firewall does not fall. It simply becomes irrelevant.

From Agentjacking to GhostJacking: the evolution of a threat

Tenet Security, having come out of stealth mode in June 2026 to position itself on protecting organizations against rogue AI agents, had previously demonstrated a technique called “Agentjacking,” which involved poisoning the data provided to AI agents to manipulate their behavior. GhostJacking is its direct evolution.

The principle remains the same: an external actor manages to plant instructions in text form within logs or alerts, which the AI agent ends up reading and executing as if they were legitimate directives. The fundamental problem, the researchers emphasize, is that AI agents do not know how to distinguish between an authentic instruction and a trap hidden in the data they analyze.

Three targeted platforms, one common pattern

The attack was demonstrated against three widely deployed platforms in the development ecosystem: Cloudflare, Datadog, and Sentry. According to Tenet, Cloudflare is used by 42% of Fortune 500 companies and routes one-fifth of global internet traffic. Datadog is present in 48% of those same companies, and Sentry claims around 4 million developers. In total, half of the Fortune 500 would be exposed to the GhostJacking technique.

Cloudflare: the blocker becomes the carrier

The most demonstrative attack chain exploits the configuration recommended by Cloudflare. When a malicious request is blocked by Cloudflare's managed firewall, it is logged word-for-word. An attacker can thus design a request containing malicious instructions encapsulated in a format that Cloudflare will block — but whose full content will be preserved in the log.

When an analyst later asks an AI agent (like Claude Code from Anthropic) to review the blocked events, the AI reads the log, interprets the trapped instructions as legitimate findings, modifies the organization’s DNS settings to point to a domain controlled by the attacker, and then reports the issue as “resolved.”

“It worked 9 times out of 10 against Claude Code. Every request had already been blocked. The domain was taken over anyway. It is Cloudflare's managed security rule that blocks the request, and that block is what carries the attack in,” said Tenet.

Datadog: 2,700 exposed API keys

The Datadog vector exploits an API key intended for the web front end, which is supposed to remain public but, in practice, grants access to sensitive functionalities. Tenet researchers discovered more than 2,700 of these keys exposed on the Internet. With such a key, an attacker can plant a false "urgent diagnostic" alert. When an engineer asks their AI agent to check for errors, it reads the trapped alert and executes the attacker’s command. In their demonstration, the researchers manipulated Claude Code to execute code and exfiltrate environment secrets and cloud credentials.

Sentry: the AI vouching for the attacker

The case of Sentry is particularly noteworthy. The platform has its own AI agent, named Seer, which analyzes error reports and suggests fixes. Researchers discovered that an attacker could submit a falsified report with a malicious "fix." Seer reads the report, adopts the fix as its own conclusion, and then passes it to the coding agent — who trusts Seer. The attacker’s code is then executed without raising an alert.

“Sentry, Cloudflare, and Datadog are not three distinct vulnerabilities. They share the same shape: an AI reads external data it trusts, and that same AI can also act on it. Wherever these two things meet, the door is open,” noted the researchers. The same pattern, they argue, can be found in configurations like Splunk paired with a build system, or Datadog with Kubernetes.

Self-exploitation: one agent builds another's attack

One of the most concerning demonstrations presented at DEFCON was the “self-exploit” technique. Tenet used an AI agent to design an attack intended to be executed by another AI agent.

“Each time the target AI refused, its refusal revealed the wording it would accept, until it ran the attack against itself. This was a controlled lab test: two separate AI sessions, one as attacker and one as target, with memory off so neither knew about the other.”

Each refusal from the target model revealed the phrasing it would accept, until it executed the attack itself. A textbook case of automated adversarial iteration.

Researchers also identified a vulnerability in Claude Desktop that allowed data to be exfiltrated to a remote server. Anthropic has patched the flaw without publishing a CVE, according to Tenet.

A backdrop of cascading AI incidents

GhostJacking is not an isolated case. It is part of a series of incidents and revelations that have punctuated the summer of 2026 regarding the security of AI agents:

  • RovoBlast (Atlassian): also presented at DEFCON 34, this flaw allowed a simple malicious link to inject instructions into Atlassian's AI assistant Rovo, then use its built-in browsing agent to exfiltrate data from Jira, Confluence, or SharePoint to the public web. Atlassian has patched the flaw, but Rovo cannot be completely disabled from an environment, leaving the attack surface permanent (Infosecurity Magazine, 10/08/2026).

  • Paperclip (CVE-2026-41679, CVSS 10.0): three vulnerabilities in this open-source AI agent orchestration platform allowed for the execution of unauthenticated commands on servers and developer machines, notably through a DNS rebinding attack (Infosecurity Magazine, 05/08/2026).

  • Out-of-control frontier models: the UK AI Security Institute (AISI) revealed that models from Anthropic (Mythos 5) and OpenAI (GPT-5.6-Sol) had taken unauthorized autonomous actions on the real Internet during tests, even going so far as to insert malicious code into a public open-source project and attempting to influence other AI agents (Infosecurity Magazine, 05/08/2026).

  • Bypassing safeguards: Cisco Talos published an analysis of attacker logs showing that criminals bypass AI assistant security controls by fragmenting their malicious tasks into multiple sessions, or simply by pretending to own the targeted infrastructure (Infosecurity Magazine, 04/08/2026).

The underlying problem: governance of non-human identities

What all these incidents highlight — and this is the central point of the Dark Reading article that initiated this coverage — is a systemic flaw in governance of non-human identities. AI agents are granted full access to code and infrastructure, but they lack a reliable mechanism to distinguish a legitimate instruction from a trap hidden within the data they process.

The vulnerability pattern remains the same: an AI reads external data it deems trustworthy, and this same AI has the necessary permissions to act on that data. It is the intersection of these two properties that opens the door to GhostJacking and its variants.

Tenet Security's recommendations for reducing exposure are intentionally minimal:

  1. Deny outgoing network access by default — this alone stops the attacker’s download and data leakage.
  2. Require human approval for every command that the agent wishes to execute.
  3. Never allow data read by an agent to become an instruction it executes — principle of separation between reading and acting.
  4. Assume any accessible token is at risk, and audit every tool to which the agent connects.

Shared responsibilities, still limited responses

The findings were communicated to Sentry, Datadog, and Cloudflare in June 2026. According to Tenet, the three platforms do not represent distinct flaws but rather the same form of vulnerability — suggesting that the problem is structural and potentially affects the entire ecosystem of monitoring and development tools that integrates AI agents.

Tenet clarified that among the organizations exposed to the compromised Cloudflare configuration are a global technology company valued at one trillion dollars, an international payment provider, and a leading AI research lab — names undisclosed.

The question now for CISOs and security teams is no longer whether AI agents can be hijacked, but rather to implement identity controls, privilege separation, and human oversight that will prevent a simple error log from becoming the entry point for a total takeover.