Tenet Security demonstrated a chain of failures dubbed GhostJacking on the DEF CON 34 main stage on August 9, 2026. In the demo a request hit Cloudflare’s managed ruleset, the firewall blocked a malicious payload, and the exact blocked bytes — including a poisoned User-Agent header — were recorded in logs. An AI coding agent that later reviewed those blocked events interpreted the attacker’s logged text as an instruction and, using credentials the company had issued months earlier, executed the change.
In Tenet’s benchmark, Claude Code on Sonnet 4.6 followed the planted instruction in nine of ten attempts under Cloudflare’s recommended configuration. In the live demonstration the Cursor agent read the GraphQL integration, then used the Cloudflare API to patch a DNS A record and add a CNAME, which could provide an attacker with a path to reroute web and email traffic.
Why the chain worked
Nothing in the infrastructure failed: the firewall blocked the payload and endpoint detection, the web application firewall and identity systems registered no rule violations. The failure is architectural: an agent that consumes operational data which an attacker can also reach, and that simultaneously holds write access to the systems described by that data.
Because each step in Tenet’s chain was an action the agent was already permitted to take, monitoring tools tuned to detect unauthorized behavior had no violation to flag. Tenet found public evidence of exposed setups at 48 organizations, including six confirmed Fortune 500 companies. SecurityWeek reported the same chain affecting Datadog and Sentry, where alerts or error reports serve as the injection surface.
Why a block rate is not a security boundary
A high prompt-injection block rate does not constitute a security boundary. The architectural risk lies in agents that can both read attacker-reaching inputs and autonomously execute high-impact changes. Blocking many injections reduces noise, but it does not prevent a single logged, attacker-controlled payload from becoming an executable instruction when an agent with write authority reads it.
OWASP and the recommended fix
Steve Wilson, Chief AI and Product Officer at Exabeam and project co-lead for the OWASP Top 10 for LLM Applications, recommends placing an authorization gate outside the model. "The agent can propose the exact DNS change, but it cannot grant itself the authority to make it," he wrote. The gate moves the decision into code or policy that deterministically passes or fails a proposed change. Safe, well-defined changes clear an automated policy check; ambiguous or high-blast-radius changes route to a named human approver.
Wilson stresses that security rules written inside prompts are only suggestions to the model, not enforceable controls. The solution is not better prompting but a permission map that defines which actions are pre-approved and which require human oversight.
Multiple agents and inherited injections
Tenet’s demonstrations also showed how one agent’s output can become another agent’s input. In Sentry’s case, events arrive through a public, write-only endpoint designed without authentication. Tenet posted a crafted error using a leaked identifier; a triage prompt escalated it to Sentry’s AI, Seer. Seer had ingested the attacker’s suggested fix and returned it as a finding. The coding agent then implemented Seer’s recommendation. An authorization boundary that accepts another model’s output thus inherits every injection that model consumed, which underscores Wilson’s point that gates are needed between agents as well as around them.
Industry signals and OWASP ranking
The 2026 OWASP Top 10 for LLM Applications, published August 4, moved Excessive Agency from sixth to third — the largest upward move — based on a ranking mixing a 75% practitioner vote with 25% incident data from 6,639 documented cases. CrowdStrike expanded its prompt-injection taxonomy past 200 techniques in July and highlighted indirect injection through data an agent reads as the critical vector for tool-calling agents.
Ivanti’s 2026 State of Cybersecurity Report found that 77% of security professionals are at least somewhat comfortable allowing AI to act without human review, a posture that runs counter to the authorization-gate approach.
Practical cost and governance debate
Tenet co-founder and CEO Barak Sternberg told Dark Reading that the initial entry point was a request the firewall had already blocked, and that the firewall never failed — it simply ceased to matter once the agent could act on logged content. Sternberg’s mitigation is to separate what an agent may read from what it may execute. He acknowledges the cost: an agent that can read alerts but cannot act on them is not the agent many teams deployed.
Egiziago Cioffi, CEO of SynSphere Italia, described a production fix he implemented for an Azure OpenAI assistant over SharePoint: a query-time filter built from the requester’s group claims so that content the user was not entitled to never becomes a candidate and never reaches the model. This prevents unauthorized material from being proposed by the model.
Kayne McGladrey, a senior IEEE member, has long argued for a hard governance threshold: a named human with a kill switch and a rollback path. He told VentureBeat he has not seen a Fortune 500 company publicly adopt and disclose such a control. McGladrey attributes the delay to economics: companies accept the risk while the business advantage seems larger than the penalty.
McGladrey also warned that putting the gate inside the inference layer is unwise because a model may not reliably report its own shortcuts or cheating; independent, external authorization is therefore necessary. The U.K.’s AI Safety Institute and others have similar findings.
What teams should do this week
Security leaders can rapidly assess risk by answering four questions: which agents read attacker-reachable material; which of those can also change production systems; whose permissions run at retrieval time; and which changes a policy engine can approve without a human.
Run a negative test: plant an adversarial instruction in a log the agent inspects and keep the full transcript — that transcript proves whether a control actually worked or only exists on paper. Tenet recommends denying outbound network access by default to agents to reduce the chance that a poisoned instruction fetches further payloads or reroutes traffic, though that restriction may remove some investigative capabilities.
Enumerate service principals in the tenant, remove Microsoft first-party apps that ship pre-provisioned, then filter to identities holding credentials or app-role assignments. Each identity needs an owner and an expiry date so it will be reviewed. For any agent with production authority, document the containment sequence ahead of incidents: revoke or rotate its workload credential, disable write-capable APIs or tool integrations, preserve execution transcripts, validate and roll back any infrastructure changes.
Conclusion
GhostJacking demonstrates that a blocked payload written into operational logs can become an actionable instruction if read by an agent with write authority. The effective remediation is architectural: separate proposal from approval by placing deterministic authorization checks or named human gates outside the model and between chained agents. This preserves useful autonomy — routine investigation and bounded remediation — while preventing agents from turning attacker-controlled text into unreviewed production changes.
