GhostJacking Attack Hijacks AI Agents to Run Malicious Code on Developer Machines

Key Takeaways

• A novel attack technique, “Ghostjacking,” exploits AI coding agents through indirect prompt injection to execute malicious code.
• The attack leverages AI agents’ access to development and cloud environments, allowing for credential theft, configuration changes, and backdoor creation.
• Tenet Security demonstrated Ghostjacking’s efficacy against integrations with Cloudflare, Datadog, and Sentry, achieving a 90% success rate in some scenarios.
• The threat bypasses traditional security measures because AI agents perform authorized actions, making detection difficult.

A sophisticated new attack vector, dubbed “Ghostjacking,” has emerged, capable of manipulating AI coding agents into executing attacker-controlled commands. This technique poses a significant threat to development and cloud environments by enabling malicious actors to alter cloud settings, exfiltrate credentials, and establish persistent backdoors.

The findings were unveiled by Tenet Security at DEF CON 34 in Las Vegas on August 9, 2026. Researchers highlighted that Ghostjacking specifically targets the expanding ecosystem of AI-driven workflows where coding assistants are granted permissions to interact with trusted tools and execute actions within development or cloud infrastructure.

Understanding the Ghostjacking Mechanism

Ghostjacking operates on the principle of indirect prompt injection. Unlike direct attacks that feed malicious instructions straight to an AI coding assistant, this method involves embedding harmful commands within data that the agent is likely to process. This could include seemingly innocuous sources such as blocked web requests, system error logs, monitoring alerts, or bug reports.

When a developer tasks an AI agent with investigating such data, the agent may inadvertently interpret the attacker’s embedded content as legitimate instructions. If the agent possesses elevated permissions—such as access to shell commands, cloud dashboards, DNS records, source code repositories, or sensitive secrets—it can then execute dangerous actions using the pre-approved organizational access.

Ghostjacking Attack Demonstrations

Tenet demonstrated the issue across integrations involving Cloudflare, Datadog, and Sentry. In one compelling scenario, an attacker initiated a malicious request targeting a website protected by Cloudflare. Although the firewall successfully blocked the request, it generated a log entry containing the attacker’s embedded instructions.

Subsequently, when an analyst directed an AI assistant to review these blocked events, the assistant processed the attacker-controlled text within the log. This led the compromised agent to modify DNS settings, effectively rerouting a company’s web and email traffic. Tenet reported a 90% success rate in tests against Claude Code using Cloudflare’s recommended configuration, underscoring the attack’s potency.

A similar exploit was demonstrated against Datadog. Researchers explained that attackers could leverage publicly exposed client-side keys to generate fabricated alerts containing urgent diagnostic instructions. An AI agent tasked with reviewing these alerts could be coerced into executing commands that expose critical environment variables and cloud credentials.

The Sentry attack chain highlighted the risk of AI-to-AI trust. Sentry’s AI assistant, Seer, could be manipulated to analyze a specially crafted issue report and subsequently generate an attacker-controlled recommendation. A separate coding agent, trusting Seer’s output, might then execute the proposed “fix” without ever directly encountering the original malicious content.

Tenet also disclosed a sandbox escape vulnerability within Anthropic’s Claude Desktop, which has since been patched. This flaw could have allowed data collected by an AI agent to bypass the sandbox’s restrictions on outbound access. Anthropic reportedly confirmed and remediated this issue prior to the DEF CON presentation.

A critical concern with Ghostjacking is its ability to bypass conventional security measures. The attack does not rely on traditional exploitation methods like authentication breaches or malware deployment. Instead, the AI agent executes actions it is authorized to perform, making it exceptionally difficult for endpoint detection systems, web application firewalls, and identity management solutions to identify the activity as malicious.

What You Should Do

• Restrict AI Agent Network Access: Implement a default-deny policy for AI agent network connectivity, granting access only to essential resources.
• Require Human Approval: Institute a mandatory human review and approval process before AI agents are permitted to execute commands or make significant changes.
• Isolate Untrusted Data: Develop mechanisms to strictly separate untrusted data sources from the instructions given to AI agents.
• Review AI Workflows: Conduct comprehensive audits of every token and external tool utilized within AI workflows to identify potential vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.