Ghostjacking: AI Agents Turn Logs Into Attacks

Researchers showed how attackers can trick a company’s AI coding/security agents into acting on fake “reports” planted in trusted systems like firewall logs and monitoring tools. The AI agent then makes real changes (like rewriting DNS) using permissions it already has, quietly bypassing firewall protections and enabling data theft or takeover.

Key findings

• Tenet Security says “Ghostjacking” uses an organization’s own AI agents to create a hidden path around firewall defenses by rerouting email and web traffic.
• A single fake bug report (or similar injected artifact) can hijack AI coding assistants and lead them to run attacker code on a developer machine.
• Because the agent uses permissions it already has, defenders may not see typical indicators of compromise; the firewall still works but becomes “irrelevant.”
• Researchers describe persistence by leaving backdoors in an agent’s “configuration, memory and tools,” enabling ongoing access for data and credential theft.
• Tenet demonstrated cross-platform risk patterns involving Cloudflare logs, Datadog alerts/keys, and Sentry’s Seer AI “vouching” for a fake fix.

Who’s being targeted

• Commonly targeted roles: Developers, DevOps/SRE, Security Operations (SOC), IT Operations, Application Security, Security leadership.
• Affected industries: Technology/Software, Financial services/payments, Any enterprise using AI agents for DevOps/SecOps workflows.
• Attack channels: website.
• Impersonated: Cloudflare firewall logs / managed security rule output, Datadog alerting/diagnostics, Sentry Seer (Sentry’s AI) / trusted incident analysis output.

Awareness takeaways

• Treat logs, alerts, tickets, and bug reports as untrusted input, don’t let AI agents execute instructions found inside them.
• Require human approval before an AI agent runs commands or makes infrastructure changes (DNS, routing, deployments).
• Reduce blast radius: lock down outbound network access for agents to prevent downloads and data leaks.
• Assume exposed tokens/keys will be abused; inventory and review every tool and key an agent can access.

Red flags to watch for

• AI is asked to act on untrusted external input copied verbatim from logs
• Recommended “fix” includes changing DNS/domain settings unrelated to the original alert
• Unusual urgency to treat a single blocked request as requiring infrastructure changes
• Alert source is not verified and relies on a key that may be exposed
• Alert includes instructions or code snippets to run without independent validation
• AI agent is granted authority to execute commands based on monitoring data
• ‘Trusted’ AI analysis is based on user-controlled or attacker-planted report content
• Fix is accepted because another tool ‘vouches’ for it rather than because it’s reviewed
• AI agent executes changes/code based on external issue text