Introduction to Ghostjacking
Tenet security researchers have demonstrated a novel AI hijacking attack that relies on tools trusted by the agent to deliver malicious instructions. The Israeli cybersecurity startup, which emerged from stealth mode in June to protect organizations from rogue agents, previously demonstrated how threat actors can poison data fed to AI agents to manipulate their behavior, an action it calls ‘Agentjacking’.
Dubbed Ghostjacking, the newly demonstrated attack builds on the same assumption: an external threat actor is able to plant instructions as text in logs or alerts to turn AI agents rogue. The underlying issue, it says, is spread widely, as the attack targets three highly trusted platforms: Cloudflare, which routes 20% of all web traffic, Datadog, and Sentry.
Attack Vectors
Cloudflare and Datadog are used by nearly half of Fortune 500 companies each, while Sentry is trusted by close to 4 million developers. The compromised agent “hijacked the domain on Cloudflare, ran code and stole cloud credentials on Datadog, and turned one AI into an insider that vouched for the attacker to the next on Sentry,” Tenet says.
Cloudflare’s recommended security configuration, the startup says, exposes organizations to one of the attack vectors: a bad request is blocked by the firewall level and logged word for word, injecting the attacker’s malicious instructions as plain text in the log.
When an analyst asks an agent to review the event, the AI reads and executes the instructions, altering the organization’s DNS settings to point to an attacker-controlled domain, and then reporting the issue as resolved.
Attack Demonstrations
Another attack vector abuses a Datadog key meant for the front end, but which is routinely left in the open, as demonstrated by the over 2,700 such keys the cybersecurity firm has found on the internet. “With that key, an attacker plants a fake ‘urgent diagnostic’ alert. When an engineer asks their AI agent to check for errors, the agent reads it and runs the attacker’s command,” Tenet notes.
The attack manipulated Claude Code into executing code and exfiltrating environment secrets and cloud credentials. To target Sentry, an attacker uses a crafted report that is read by Sentry’s AI agent Seer, which adopts a proposed fake fix as its own.
When the fix is passed to the coding agent that trusts Seer, the attacker’s code is executed. Tenet also says it used an AI agent to devise the attack that would be carried out by another agent.
Vulnerabilities and Fixes
Tenet also found a vulnerability in Claude Desktop that could be exploited to exfiltrate data to a remote server. Anthropic has fixed the flaw without issuing a CVE, Tenet says.
“Sentry, Cloudflare, and Datadog are not three separate flaws. They are the same shape. An AI reads outside data it trusts, and the same AI can also act on it. Wherever those two things meet, the door is open. The same pattern shows up far beyond these three, in setups like Splunk with a build system, or Datadog with Kubernetes,” the company notes.
Source: SecurityWeek