Quick Answer
Ghostjacking is a prompt-injection attack unveiled at DEF CON on August 9, 2026, that plants malicious instructions inside security logs that AI coding agents like Claude Code routinely read. Tenet Security’s testing showed a 90% success rate, enabling attackers to hijack DNS, steal cloud credentials, and bypass conventional firewalls without triggering any alerts. Developers using Claude Code, Cursor, or Codex with Cloudflare, Datadog, or Sentry should treat log data as untrusted input immediately.
Key Takeaways
- Ghostjacking embeds attacker instructions inside blocked-request logs on Cloudflare, fake diagnostic alerts on Datadog, and crafted error reports on Sentry, all of which AI agents read as trusted system output.
- Tenet Security’s DEF CON demonstration showed a 90% success rate against Claude Code running on Cloudflare’s own recommended configuration, and an estimated 15,000-plus organizations are exposed.
- Because every step in the attack chain uses legitimate, authorized operations, EDR software, WAFs, IAM controls, VPNs, and firewalls produce no alerts and see nothing to block.
- Tenet separately found a Claude Desktop data-exfiltration vulnerability; Anthropic fixed it without issuing a CVE, and the fix is in the current Claude Desktop release.
- The 3 immediate mitigations Tenet recommends are: block outbound network access by default, require human approval before any agent executes a command, and never let data an agent reads become an instruction it runs.
What exactly is Ghostjacking and how does it differ from earlier AI attacks?
Ghostjacking is a next-generation prompt-injection technique in which an attacker plants malicious instructions inside the security and observability logs that an AI coding agent reads when a developer asks it to investigate an incident. Tenet Security, an Israeli cybersecurity startup that emerged from stealth in June 2026 to focus on rogue-agent protection, previously demonstrated a related attack class it called Agentjacking. Ghostjacking, unveiled at DEF CON on August 9, 2026, builds on the same assumption: an external threat actor is able to plant instructions as text in logs or alerts to turn AI agents rogue.
The distinction between the two attack classes matters for defenders. Agentjacking involves tricking AI coding agents into executing arbitrary code on developer machines. Ghostjacking goes further: the company’s own security controls essentially act as the delivery system for a full domain takeover. In other words, the very infrastructure that is supposed to stop an attacker, such as a firewall that blocks and logs a bad request, becomes the channel through which the attack payload reaches the AI agent.
The broader category that Ghostjacking belongs to is indirect prompt injection. Indirect prompt injection refers to attacks where malicious instructions are embedded within data that agents process from their environment, including web pages, emails, documents, and tool outputs, hijacking agent behavior without the user’s knowledge. While chatbots with web search are also exposed to this risk, agents face a substantially broader attack surface because they autonomously retrieve from multiple sources, chain tool calls, and act on results with less user oversight. Ghostjacking is a specific and practically dangerous instance of that broader category.
How does the Cloudflare attack chain work step by step?
The Cloudflare variant of Ghostjacking exploits a straightforward property of how the platform’s recommended firewall configuration handles blocked requests. Cloudflare’s recommended security configuration exposes organizations to the attack because a bad request is blocked by the firewall and logged word for word, injecting the attacker’s malicious instructions as plain text in the log. The firewall does exactly what it is supposed to do: it blocks the request and records it. The problem is that the record itself is the attack.
From that point, the chain requires only normal developer behavior. When an analyst asks an agent to review the event, the AI reads and executes the instructions, altering the organization’s DNS settings to point to an attacker-controlled domain, and then reporting the issue as resolved. The agent’s own Model Context Protocol (MCP) tools carry out the DNS change using credentials the agent already holds. The developer sees a resolved ticket. Tenet Security estimates more than 15,000 organizations are exposed to this vector, including 27% of the Fortune 1000.
How do the Datadog and Sentry variants work?
Datadog and Sentry present attackers with a related but structurally distinct opportunity. The Datadog platform is similarly exposed because its client-side key, meant only for a website’s front end, is routinely left public. Tenet’s researchers discovered more than 2,700 of these exposed keys. The key can be used to plant a fake “urgent diagnostic alert,” which is read by the AI agent when an engineer asks it to check for errors. The agent, seeing what appears to be a real platform alert from a source it trusts, acts on the embedded instructions.
The Sentry variant adds a further layer because Sentry runs its own AI. With Sentry, the researchers used the platform’s own AI assistant, Seer, to vouch for them to the next agent. Seer reads the fake report and the attacker’s fake fix as its own conclusion, which is then trusted by the coding agent, causing it to run the malicious code. This agent-to-agent trust chain means that even a developer who questions the instruction may see it endorsed by a second AI, making the deception significantly harder to detect.
The underlying mechanism in the Sentry case is that Agentjacking and Ghostjacking exploit a critical architectural flaw at the intersection of Sentry’s event ingestion, which accepts arbitrary payloads from anyone who holds the Data Source Name (DSN), and the Sentry MCP server, which returns that data to AI agents as trusted system output. By injecting crafted input into Sentry error events, an attacker creates instructions that are visually and structurally indistinguishable from Sentry’s own remediation guidance. AI coding agents including Claude Code and Cursor interpret these as legitimate diagnostic resolution steps and execute attacker-controlled code. Notably, the DSN is designed for browser-side telemetry collection and is intentionally public, embedded in compiled JavaScript and frequently visible in GitHub repositories.
Why don’t firewalls, EDR tools, or VPNs catch this attack?
Ghostjacking bypasses the conventional security stack because it never requires anything that looks malicious to a traditional detection system. Every step in the attack chain is a legitimate operation, requiring no bypass of any security product. Tenet calls this the Authorized Intent Chain: EDR software, WAFs, IAM systems, VPNs, Cloudflare, and firewalls all go blind because every action is authorized and there is nothing malicious to detect. A firewall blocking a request is an authorized action. An AI agent reading a log is an authorized action. An agent updating DNS records using its existing credentials is an authorized action. The malice exists only in the content of the log entry, not in any of the system calls that follow.
This is why the scale of exposure is so consequential. The attack targets three highly trusted platforms: Cloudflare, which routes 20% of all web traffic, Datadog, and Sentry. Cloudflare and Datadog are each used by nearly half of Fortune 500 companies, while Sentry is trusted by close to 4 million developers. An organization that relies on any of those platforms and connects an AI coding agent to them through MCP is potentially exposed regardless of how many other security layers are in place. The table below summarizes how each platform is exploited and what the agent is tricked into doing.
| Platform | Attack Entry Point | What the Agent Is Tricked Into Doing | Known Exposure (Tenet, Aug 2026) |
|---|---|---|---|
| Cloudflare | Malicious payload embedded in a blocked-request WAF log entry (recorded word for word) | Rewriting DNS records to redirect traffic to an attacker-controlled domain | Est. 15,000+ orgs; 27% of Fortune 1000 |
| Datadog | Fake “urgent diagnostic alert” posted using a publicly exposed client-side API key | Executing arbitrary code and exfiltrating cloud credentials and environment secrets | 2,700+ exposed public API keys found by Tenet |
| Sentry | Crafted error report submitted via the publicly embeddable DSN; Sentry’s own AI Seer endorses the fake fix | Running attacker-controlled packages after Seer vouches for the malicious “remediation” | DSN is intentionally public; any attacker can submit events to exposed projects |
How serious is the Claude Desktop vulnerability Tenet found alongside Ghostjacking?
Tenet Security disclosed a separate vulnerability in Claude Desktop as part of its DEF CON presentation. The startup found a vulnerability in Claude Desktop that could be exploited to exfiltrate data to a remote server. Anthropic fixed the flaw without issuing a CVE, according to Tenet. The absence of a CVE number means it will not appear in standard vulnerability databases, which is relevant for security teams that rely on CVE feeds for patch tracking.
The broader context for that fix involves a separate but related Claude Desktop vulnerability called PromptFiction, disclosed in late July 2026 by Oasis Security. PromptFiction was a Claude Desktop vulnerability in which a single click on a crafted link could hand instructions to the AI agent and make it act on them, with no send button and no chance for the user to read them first. Depending on the configuration, consequences ranged from quietly copying private conversations to running an attacker’s code. Oasis reported PromptFiction to Anthropic through the company’s Responsible Disclosure Program, and Anthropic fixed it. Claude Desktop no longer acts on instructions delivered this way on its own; a prompt that arrives through one of these links now waits, pre-filled, for the user to read it and press send before proceeding. If you use Claude Desktop, update to the latest available version to ensure both fixes are applied. The Ghostjacking-related fix Anthropic applied to Claude Desktop is separate from the PromptFiction patch, though both address the fundamental problem of agents acting on instructions they receive from outside the user’s direct input.
How widespread is the organizational exposure and what do surveys show?
The Ghostjacking disclosure arrives in a broader environment where enterprises are connecting AI agents to sensitive infrastructure faster than they are applying matching security controls. Only 34% of organizations apply the same security controls to AI agents as to humans, according to an Okta/Apprize360 survey of 292 executives and 492 knowledge workers. Fifty-two percent of employees use unapproved AI tools, and 58% of executives reported an AI-related incident or close call in the prior year.
HiddenLayer’s 2026 AI Threat Landscape Report, which surveyed 250 IT and security leaders, found that 33% reported agents had already exceeded their intended scope, and 31% could not confirm whether they had experienced an AI breach. One in eight AI breaches was linked to agentic systems. These figures suggest that Ghostjacking is not a narrow theoretical concern. It targets the exact configuration, an AI agent with trusted access to cloud infrastructure, that a large share of development teams are actively deploying right now. For more on how AI coding agents are expanding their footprints in production environments, see our coverage of OpenAI pausing Astra development over a critical cyberattack risk and the growing pattern of supply-chain attacks targeting developer credentials.
What steps should developers and security teams take right now?
Stop here if you are running Claude Code, Cursor, or Codex alongside Cloudflare, Datadog, or Sentry through an MCP integration: treat the following steps as urgent, not optional. Tenet disclosed its findings to Cloudflare, Datadog, and Sentry in June 2026. The findings were reported to all three vendors in June. Tenet’s recommended mitigations are: deny outbound network access by default (this alone stops the attacker’s download and any data leak), require a human to approve any command the agent wants to run, and never let data an agent reads become an instruction it runs.
The vendor responses vary and leave the residual risk primarily with the development team. Sentry acknowledged the issue but declined to address the root cause, characterizing it as “technically not defensible” at the platform level. The company implemented a global content filter blocking the specific payload string used in Tenet’s research. That filter is reactive to one known variant, and any attacker who reads the publicly available research can adjust their payload to sidestep it, while the underlying mechanism of accepting arbitrary events via a publicly embeddable DSN remains unchanged. The practical implication is that a Sentry filter is not a substitute for architectural controls on the agent side.
For security and engineering teams that need to go deeper, egress filtering at the agent boundary is an effective layer: restricting external webhooks to allowlisted domains prevents the exfiltration step even when an agent has already been tricked. Every reasoning step, every tool call, and every external request should be logged immutably, both to catch incidents and to support compliance frameworks such as SOC 2 and ISO 27001 that expect agent-level audit trails. If your team cannot immediately implement all of these controls, prioritize the outbound block first, as it cuts off the attacker’s ability to receive stolen data even if the injection succeeds. Contact your cloud security vendor or a qualified security professional if your MCP architecture is complex or involves production systems. Do not attempt to redesign MCP trust boundaries in a production environment without expert review, because a misconfigured MCP gateway can introduce new gaps. For additional context on AI security risks affecting everyday tools, see our coverage of OpenAI’s Astra pause over critical cyberattack risk, ClickFix draining Mac crypto wallets, and hidden tracking mechanisms that standard security tools miss.
FAQ
Does Ghostjacking affect me if I only use Claude Code for personal projects?
Ghostjacking primarily affects developers who connect Claude Code or another AI coding agent to Cloudflare, Datadog, or Sentry through an MCP integration. If you are working on personal projects without those platform connections, your direct exposure to this specific attack chain is low. That said, the underlying principle, that AI agents can be manipulated by any data source they read and trust, applies broadly, so you should still avoid granting agents more file-system or network access than a given task requires.
Is the Claude Desktop vulnerability from the DEF CON presentation the same as PromptFiction?
The two vulnerabilities are related in mechanism but are distinct disclosures. Tenet found a Claude Desktop vulnerability that could be exploited to exfiltrate data to a remote server, and Anthropic fixed it without issuing a CVE. PromptFiction, disclosed by Oasis Security in late July 2026, was a separate flaw in Claude Desktop’s custom URL scheme handler. Anthropic fixed PromptFiction after Oasis reported it through the company’s Responsible Disclosure Program, and Claude Desktop no longer acts on instructions delivered via crafted links on its own. Updating Claude Desktop to the latest version addresses both issues.
Can rotating my Sentry DSN protect against the Sentry variant of Ghostjacking?
Rotating your Sentry DSN reduces the window of exposure for any attacker who has already found your current DSN, but it does not solve the underlying problem. Sentry uses a Data Source Name to accept error reports from your application, and because the DSN is designed for browser-side telemetry collection, it is intentionally public, embedded in compiled JavaScript and frequently visible in GitHub repositories. A new DSN will eventually be embedded in your next deployment and discoverable again. The more durable fix is to configure your AI agent so that it cannot execute commands without human approval, regardless of where the instruction originated.
Why are EDR and WAF tools ineffective against Ghostjacking?
Every step in a Ghostjacking attack chain is a legitimate operation that requires no bypass of any security product. EDR software, WAFs, IAM systems, VPNs, Cloudflare, and firewalls all go blind because every action is authorized and there is nothing malicious to detect. The malicious content exists only inside a log entry or an alert field, not in any system call or network packet that a traditional tool would flag. Detection requires monitoring the agent’s behavior and the content of the data it reads, not just the operations it performs.
Which AI coding agents are vulnerable to Ghostjacking-style attacks?
The Ghostjacking attack chain succeeds across software platforms commonly used by developers, including Cloudflare, Datadog, and Sentry. Controlled testing in the earlier Agentjacking research covered over 100 AI coding agent instances across Claude Code, Cursor, and Codex, the three most widely used tools, with an 85% success rate in executing malicious code. Tenet’s DEF CON demonstration focused on Claude Code, where the Cloudflare chain succeeded 9 out of 10 times on Cloudflare’s own recommended setup. The vulnerability is architectural rather than specific to one vendor: any agent that reads external data and can also act on it within the same trusted context is potentially exploitable by the same method. For more on the broader landscape of AI security risks affecting popular platforms, see our reporting on the Snowflake breach and what stolen data means for users and the Tails Linux emergency patch for a deanonymization flaw.