An incident involving a security agent who accessed a Cloudflare log and discovered an attacker’s prompt-injection payload led to a DNS rewrite for the company. Although the firewall had already blocked the payload, this action logged the attempt.
This sequence, known as GhostJacking, was showcased by Tenet Security at DEF CON 34 on August 9. A request is intercepted by Cloudflare’s managed ruleset, blocked, and recorded byte-by-byte with its malicious User-Agent header. An AI coding agent reviewing these blocked events interprets the attacker’s text as a legitimate instruction and executes it using credentials issued earlier by the company. In a benchmark by Tenet, the Claude Code on Sonnet 4.6 followed the malicious instruction in nine out of ten attempts with Cloudflare’s recommended settings.
The block rate is not the boundary
Despite the firewall functioning correctly and subsequent calls carrying valid credentials, no alarms were raised by endpoint detection, web application firewalls, or identity management systems.
Tenet found 48 organizations publicly exposed to this setup, including six Fortune 500 companies. SecurityWeek noted similar incidents with Datadog and Sentry, where alerts or error reports served as injection surfaces. A simple platform patch cannot eliminate the architectural risk posed by an agent accessing attacker-reachable data and independently executing significant changes. Thus, a high prompt-injection block rate is insufficient as a security boundary.
OWASP’s co-lead names the fix
Steve Wilson, Chief AI and Product Officer at Exabeam and OWASP Top 10 for LLM Applications co-lead, suggests placing an authorization gate outside the model. This measure prevents the agent from autonomously executing DNS changes, ensuring a human approves significant alterations.
Wilson outlines that this approach confines decision-making to code that either passes or fails a deterministic policy check. Safe changes proceed independently, while ambiguous or high-risk actions require human approval.
Wilson emphasizes that security rules within prompts may influence model behavior but do not enforce security controls.
The blocked payload became the instruction
GhostJacking requires neither a compromised admin account nor a bypassed firewall. It exploits an agent authorized to read operational data and write to the described systems. Each step in Tenet’s sequence is permissible, leaving no room for tools designed to detect unauthorized actions.
SC Media reported that Cloudflare’s live demonstration involved the Cursor agent, which read through a GraphQL integration and wrote via the Cloudflare API. Tenet tested multiple coding agents, with Cursor leading the demonstration and separate tests yielding a nine-out-of-ten success rate for Claude Code. Cursor processed the malicious header, altered the DNS A record, and added a CNAME, enabling attackers to reroute the company’s web and email traffic.
One agent’s output became the next agent’s input
Sentry’s public write-only endpoint, designed without authentication, allowed Tenet to post a crafted error report using a leaked identifier. The coding agent, upon receiving a triage prompt, escalated the report to Sentry’s AI, Seer, trusting the resulting analysis. Seer, having already processed the attacker’s fix, provided it as its own finding, which the coding agent implemented.
This occurrence bypassed Sentry’s control, which instructed agents not to follow directives found in event data. The coding agent adhered strictly to this rule, acting on Seer’s conclusion, which belonged to the attacker. Accepting another model’s output inherits any injections absorbed by that model, underscoring the need for a gate between agents as proposed by Wilson.
OWASP moved excessive agency from sixth to third
The 2026 OWASP Top 10 for LLM Applications, released on August 4, elevated Excessive Agency from sixth to third in a ranking combining a 75% practitioner vote with 25% incident data from 6,639 documented cases. This significant rise reflects real-world incidents clustered in agentic deployments.
The solution lies not in better prompting but in a permission map defining pre-approved actions and those requiring human intervention. Tasks like reading logs, correlating alerts, and drafting timelines remain autonomous, while DNS changes, identity privilege alterations, code deployment, or traffic rerouting require human approval. Allowing agents to open new access paths or authorize their proposals undermines the gate’s purpose. Essential autonomy remains intact, but the path from an attacker’s text to unreviewed production authority does not.
What the control costs in practice
Barak Sternberg, Tenet co-founder and CEO, told Dark Reading that a blocked firewall request initiated the breach, and the firewall remained operational, rendering it irrelevant. His solution involves separating what an agent can read from what it can execute, acknowledging the cost since an agent that reads alerts but cannot act on them is not the intended deployment. The more affordable initial step is to inventory agents that read external data and also write or execute, adding them to a risk register without needing new tools.
Wilson’s design mitigates this cost by differentiating between proposal and approval rather than read and write. The agent continues to read alerts, investigate, and perform bounded tasks while losing the ability to invent and execute high-impact changes independently.
Few have implemented this solution. Kayne McGladrey, an IEEE senior member, argues for a hard governance threshold, with a named human managing a kill switch and rollback. He noted the absence of public acknowledgment by Fortune 500 companies using such measures. McGladrey suggests companies accept these risks, either consciously or unconsciously, as penalties do not currently outweigh benefits. The gate’s placement outside the model is unrelated to malice, as models within the inference layer may not disclose or may lie about their shortcuts, as highlighted by the U.K.’s AI Safety Institute.
The industry faces challenges in swiftly implementing these changes. Ivanti’s 2026 State of Cybersecurity Report indicates 77% of security professionals are at least somewhat comfortable with AI acting without human review, a stance that Wilson’s gate seeks to constrain. In July, CrowdStrike expanded its prompt-injection taxonomy beyond 200 techniques, identifying indirect injection through data as a critical vector for agents executing commands.
The architect who moved the boundary before the attack had a name
Egiziago Cioffi encountered a similar production failure before GhostJacking was named. As CEO of SynSphere Italia, a Microsoft reseller, he designed and sold the system, unlike a security leader defending an inherited one. His Azure OpenAI assistant over SharePoint demonstrated high faithfulness but provided content inaccessible to the requesting user. Cioffi implemented a query-time filter using the user’s group claims to prevent unauthorized content from reaching the model. GhostJacking hinges on model capabilities, which Wilson’s gate addresses.
A gap remains, as no sitting CISO has publicly disclosed changes made since August 9 or their impact on agent capabilities. Until then, the cost aspect relies on those defining the control rather than those defending production environments.
What security leaders need to do this week
Security leaders can gain clarity by addressing four questions: which agents read attacker-reachable material, which can alter production systems, whose permissions apply at retrieval, and which changes a policy engine can approve without human involvement.
To test defenses, plant an adversarial instruction in a log for the agent to inspect, retaining the transcript to demonstrate control effectiveness.
Tenet recommends denying agents default outbound network access to prevent poisoned instructions from fetching payloads and rerouting traffic. However, an agent investigating without internet access loses few essential capabilities.
Security leaders should identify service principals in the tenant, exclude pre-provisioned Microsoft apps, and filter those with credentials or app-role assignments. Each identity requires an owner and an expiry date to ensure regular reviews.
For agents with production authority, establish a containment sequence before incidents occur. This involves revoking or rotating workload credentials, disabling write-capable APIs, preserving execution transcripts, and validating and reversing infrastructure changes.
McGladrey highlights a societal tolerance for AI that is unprecedented. GhostJacking exposes this reality, as blocked payloads reach agents through systems designed to log such events. The critical question is whether models have the authority to turn these into production changes.
