A newly identified cyberattack technique, termed “Ghostjacking,” enables malicious actors to manipulate AI coding agents into executing unauthorized commands. This method can lead to unauthorized changes in cloud configurations, credential theft, and the establishment of persistent backdoors within systems.
Presented by Tenet Security at DEF CON 34 in Las Vegas on August 9, 2026, Ghostjacking targets AI-driven workflows where coding assistants interact with trusted tools to perform actions in development or cloud environments.
Mechanism of Ghostjacking
Ghostjacking operates through indirect prompt injection. Instead of delivering a malicious command directly to an AI coding assistant, attackers embed harmful instructions within data that the agent is likely to process. This data can include blocked web requests, error logs, monitoring alerts, or bug reports.
When a developer instructs an AI agent to analyze such data, the agent may misinterpret the embedded malicious content as legitimate instructions. If the agent possesses access to shell commands, cloud dashboards, DNS records, source code, or sensitive information, it could execute harmful actions using the organization’s existing permissions.
Demonstrated Exploits
Tenet Security demonstrated Ghostjacking across integrations with Cloudflare, Datadog, and Sentry:
- Cloudflare: An attacker sends a malicious request to a website protected by Cloudflare. The firewall blocks the request and logs it. When an analyst uses an AI assistant to review the blocked events, the assistant processes the attacker-controlled text within the log. This could lead to unauthorized modifications of DNS settings, redirecting a company’s web and email traffic.
- Datadog: Attackers utilize publicly exposed client-side keys to generate fake alerts containing urgent diagnostic instructions. An AI agent reviewing these alerts might execute commands that expose environment variables and cloud credentials.
- Sentry: Focusing on AI-to-AI trust, Sentry’s AI assistant, Seer, analyzes a crafted issue report and produces an attacker-controlled recommendation. Another coding agent might trust Seer’s conclusion and implement the proposed fix without recognizing the original malicious content.
Additionally, Tenet disclosed a now-patched sandbox escape in Anthropic’s Claude Desktop. This flaw could have allowed data collected by an AI agent to exit a sandbox designed to restrict outbound access. Anthropic confirmed and addressed the issue before the DEF CON presentation.
Ghostjacking is particularly concerning because it doesn’t rely on traditional exploitation methods like breaking authentication or deploying malware. Instead, the AI agent performs authorized actions, making it challenging for endpoint detection, web application firewalls, and identity systems to identify the activity as malicious.
To mitigate the risks associated with Ghostjacking, Tenet recommends the following measures:
- Restrict AI-agent network access by default.
- Require human approval before executing commands.
- Separate untrusted data from agent instructions.
- Review every token and external tool used in an AI workflow.
As AI integration in development environments becomes more prevalent, understanding and defending against techniques like Ghostjacking is crucial. Organizations must implement stringent security protocols and maintain vigilance to prevent AI agents from becoming vectors for cyberattacks.
