Summary
- Tenet Threat Labs demonstrated attacks in which malicious instructions embedded in logs or alerts were consumed by operational AI agents.
- The risk emerges when an agent can read attacker-controlled data and also take privileged action through connected infrastructure tools.
- GhostJacking is controlled research rather than evidence of widespread exploitation, but it exposes a practical trust-boundary problem in agentic systems.
AI agents allowed to investigate and remediate operational problems can be manipulated through the logs and alerts they are trusted to analyse, according to research demonstrating how attacker-controlled data can influence privileged automation.
Tenet Threat Labs presented the work, which it calls GhostJacking, at DEF CON 34. The researchers constructed attack chains involving operational platforms including Cloudflare, Datadog, and Sentry.
The underlying weakness is a collision between data and instruction. An AI agent may be designed to retrieve an alert, determine what happened, and then use connected tools to alter infrastructure, investigate systems, obtain additional information, or remediate the issue.
If attacker-controlled text inside that alert is interpreted as an instruction rather than untrusted evidence, the agent can apply permissions the attacker does not possess directly.
Tenet demonstrated scenarios beginning with malicious content inside logs or alerts and ending with actions against systems available to the agent. The researchers also showed agent-to-agent behaviour in which one compromised workflow could influence another.
The findings are controlled demonstrations. Tenet does not present GhostJacking as evidence that attackers are already compromising large numbers of production AI agents through poisoned logs, and the distinction between demonstrated architecture risk and observed campaign activity needs to remain explicit.
The research nevertheless exposes a material design problem. Logs have traditionally been treated as passive evidence. They can contain hostile or misleading content, but reading them does not ordinarily give that content authority over the system analysing it.
Agentic automation changes that relationship when the same component can both interpret the information and act. A log entry, support ticket, monitoring alert, code comment, email, or other externally influenced record can become part of a control path if a model is permitted to transform its interpretation into privileged tool calls.
The result resembles a confused-deputy problem. An attacker without authority to modify DNS, retrieve cloud credentials, or execute administrative actions may be able to influence an agent that already has those permissions.
Tenet’s research also included a separate sandbox-escape issue affecting Claude Desktop. The company says the vulnerability was reported to Anthropic, confirmed, and remediated before the DEF CON presentation.
That combination reinforces why model-level guardrails are only one part of agent security. An operational agent also inherits the permissions, credentials, network access, and execution capabilities exposed by the software around it.
Risk therefore depends heavily on architecture: which sources the agent trusts, how retrieved content is separated from system instructions, which tools it can invoke, what changes require human approval, and whether compromise of one data source can trigger actions in a higher-trust environment.
As AI agents move closer to cloud administration, security operations, incident response, and software development, they are being placed precisely where attacker-controlled telemetry and privileged tools coexist. GhostJacking shows how that useful combination can also create a route from untrusted data to authorised action.
