GhostJacking Turns Trusted Security Alerts Into Agent Commands

Key Takeaways

• Blocked attacker requests remained dangerous inside security logs.
• Agents confused untrusted telemetry with operational instructions.
• Demonstrations affected Cloudflare, Datadog, and Sentry workflows.
• Legitimate permissions amplified the injected instructions.
• All reported attacks were controlled laboratory tests.

Security Telemetry Became a Hidden Command Channel

GhostJacking demonstrated that security logs and alerts can carry indirect prompt injections into AI-assisted investigation workflows. An attacker’s request may be blocked correctly, yet its text remains in telemetry that a privileged agent later reads. SecurityWeek described demonstrations involving Cloudflare, Datadog, and Sentry that led agents toward unauthorized remediation actions.

What We Know

The technique was publicly demonstrated at DEF CON and reported on August 10, 2026. Dark Reading’s coverage described malicious instructions placed in data that trusted security or development systems preserved for later analysis. In the Cloudflare scenario, a blocked request was recorded in a log.

When an AI agent reviewed the event, it followed the embedded instruction and altered DNS toward an attacker-controlled destination. In the Datadog scenario, a crafted alert led a coding agent to run commands and expose environment or cloud credentials.

In the Sentry scenario, poisoned issue content influenced an AI-generated fix that was then trusted by another coding agent. Reporting described a high success rate against Claude Code in the Cloudflare laboratory setup, but that result should not be generalized to every model or deployment.

What Could Happen

The attack begins before an AI agent is involved. A threat actor sends a request, error string, event name, support message, or payload that a defensive system records verbatim. The security control may block the original action, but the attacker’s language survives in logs or alerts.

• Later, an agent receives a legitimate task to investigate the event and interprets the embedded text as instructions.
• If the same agent can also modify DNS, execute diagnostic commands, access secrets, propose code, or trigger remediation, the poisoned telemetry becomes an action channel.
• Multi-agent workflows can compound the problem when one agent’s analysis is treated as trusted input by another.

Why It Matters

Security operations agents are attractive targets because they are intentionally connected to high-value telemetry and response tools. They may inspect cloud infrastructure, endpoints, application errors, code repositories, and credentials while also receiving authority to remediate incidents quickly.

Poisoned telemetry can bypass an organization’s intuitive trust model: analysts generally expect logs from a security platform to be evidence, not executable guidance. A successful attack could transform the defensive workflow into an insider-like channel operating under legitimate service identities.

The lack of confirmed production exploitation limits the current business-impact score, but the demonstrated consequences include credential disclosure, infrastructure modification, and software changes.

PointGuard AI Perspective

PointGuard AI recommends placing policy enforcement between agent reasoning and every consequential security action. Agent Mission Control validates agent actions before execution and provides behavioral monitoring, circuit breakers, and kill switches for activity that deviates from policy or mission.

MCP Security Gateway governs how agents reach tools and data, applying identity-aware authorization and guardrails to tool interactions. Adaptive Red Team Testing can test whether logs, alerts, ticket content, and tool responses can redirect an agent during realistic operational workflows.

Defenders should not assume that content is trustworthy because it came through a trusted security platform.

The relevant context includes who created the underlying event, whether fields contain external input, what task the agent was assigned, what tool it proposes to call, and whether the action matches an approved response procedure. Read-only investigation and write-capable remediation should be separated wherever practical.

Incident Scorecard Details

Total AISSI Score: 7.3/10

Criticality: 9, The demonstrations reached DNS, code execution, cloud credentials, and security operations. AISSI weighting: 25%

Propagation: 8, The pattern can recur across logs, alerts, tickets, integrations, and chained agents. AISSI weighting: 20%

Exploitability: 5, Controlled proofs of concept succeeded, but production exploitation was not confirmed. AISSI weighting: 15%

Supply Chain: 8, The attack crosses third-party observability, security, cloud, and coding platforms. AISSI weighting: 15%

Business Impact: 6, Potential consequences are severe, though no verified customer damage was reported. AISSI weighting: 25%

Sources

• SecurityWeek: GhostJacking Attack
• Dark Reading: GhostJacking Identity and Governance Gaps