Log Poisoning

Log poisoning is a cyberattack technique where threat actors inject malicious or false entries into system logs to hide their activities, manipulate audit trails, or trigger unintended system behavior. This matters for AI governance because comprehensive logging and audit trails are fundamental to demonstrating compliance with regulations like SOX, HIPAA, and EU AI Act requirements, and poisoned logs undermine the integrity of governance evidence. Organizations must implement immutable logging systems and anomaly detection to protect their log infrastructure from poisoning attacks and maintain trustworthy records of AI system decisions and data access.

1 item

ResearchGlobal2026-08-10

Ghostjacking: Poisoned Logs Turn Enterprise AI Agents Into Attack Tools

Israeli cybersecurity firm Tenet demonstrated at DEF CON a new attack class called Ghostjacking, in which adversaries embed malicious instructions as plain text inside logs and monitoring alerts on platforms including Cloudflare, Datadog, and Sentry. AI agents that ingest those logs then execute the attacker-controlled commands as though they were legitimate instructions. In one test scenario, the attack succeeded nine out of ten times against Claude Code, causing the agent to alter DNS settings and falsely report the incident as resolved.

agentic AI prompt injection Ghostjacking Claude Code Tenet AI security enterprise risk log poisoning