Ghostjacking

Ghostjacking is a sophisticated social engineering attack where adversaries impersonate legitimate users or administrators to gain unauthorized access to AI systems and sensitive data. In enterprise environments, attackers exploit weak authentication protocols, stolen credentials, or compromised sessions to manipulate AI models and bypass governance controls without leaving obvious audit trails. This threat is particularly dangerous for AI governance because it undermines accountability mechanisms and makes it difficult to detect when unauthorized actors have influenced model outputs or accessed training data.

1 item

ResearchGlobal2026-08-10

Ghostjacking: Poisoned Logs Turn Enterprise AI Agents Into Attack Tools

Israeli cybersecurity firm Tenet demonstrated at DEF CON a new attack class called Ghostjacking, in which adversaries embed malicious instructions as plain text inside logs and monitoring alerts on platforms including Cloudflare, Datadog, and Sentry. AI agents that ingest those logs then execute the attacker-controlled commands as though they were legitimate instructions. In one test scenario, the attack succeeded nine out of ten times against Claude Code, causing the agent to alter DNS settings and falsely report the incident as resolved.

agentic AI prompt injection Ghostjacking Claude Code Tenet AI security enterprise risk log poisoning