GhostJacking: how poisoned logs hijack your AI coding agent
If your AI coding agent reads Cloudflare logs, Datadog traces, or Sentry errors, it is now a potential attack surface. Researchers at Tenet Security demonstrated this at DEF CON on August 9, 2026, under the name GhostJacking.
What happened
GhostJacking is a prompt injection attack delivered through the observation plane, not the application layer. The attacker does not need access to your repository, your cloud credentials, or your developer workstation. They need to write one crafted line into a log stream the agent monitors.
When an AI coding agent like Claude Code inspects a Cloudflare Access log, a Datadog trace, or a Sentry error event, it treats that content as trusted environmental context. GhostJacking plants instructions inside that content. Because the agent sees the log output as factual data about the system, it follows the embedded instructions.
Tenet Security tested this against real-world agent setups. Success rate: 90%. Demonstrated outcomes: DNS record hijacking, cloud credential exfiltration, and firewall rule modification, all without triggering a single conventional security alert.
Why this matters now
AI coding agents are being given elevated permissions precisely because they are useful: they can read infrastructure logs, run CLI commands, query databases, and push configuration changes. The same access that makes them powerful makes them a high-value hijack target.
GhostJacking does not require malware, CVE exploitation, or insider access. An attacker who can write to any log source the agent monitors can redirect agent behavior completely. That includes: any SaaS vendor with a logging integration, any third-party error reporting service, any observability pipeline that is not tightly scoped.
The 90% success rate is not a proof of concept statistic. It reflects testing against real agent deployments at real organizations. Half of the Fortune 500 run tools with these integrations, per Tenet's analysis.
What to do
Scope agent read permissions to the specific log queries needed for each task, not to entire log pipelines.
Add a sanitization layer between raw tool output and agent context: any content containing natural-language instructions should be flagged or blocked before the agent processes it.
Treat this as indirect prompt injection. The same defenses that apply to user-supplied input apply to tool output: validate structure, reject unexpected content types, and log what the agent actually reads before acting.
Do not grant agents permission to modify DNS, firewall rules, or production credentials without a human confirmation step. GhostJacking demonstrated that this is not a theoretical attack path.
The bigger picture
The AI agent security problem is not primarily about jailbreaking models. It is about the trust model of the systems agents operate in. GhostJacking illustrates that any data source with write access from an untrusted party, if read by an agent with elevated permissions, is a potential attack vector.
This is the agentic equivalent of SQL injection: structured data that an interpreter treats as code. The field learned that lesson in the mid-2000s. The agentic security field needs to learn it now, before production deployments normalize unsafe trust boundaries.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are building agent security controls and want to compare notes.