GhostJacking: Poisoned Logs Turn AI Coding Agents Against Developers

Two months ago, Tenet Security’s Threat Labs showed how a single POST request to Sentry’s public API could hijack an AI coding agent and execute arbitrary code on a developer’s machine. That was Agentjacking. At DEF CON on August 9, Tenet returned with GhostJacking — the same class of attack, now targeting Cloudflare, Datadog, and Sentry together, with a 90% exploitation success rate and an exposed population of more than 15,000 organisations.

The core mechanism hasn’t changed. AI coding agents integrated with observability and infrastructure tools treat data from those tools as trusted context. An attacker who can write content into those data streams can embed instructions that the agent will follow without question, because from the agent’s perspective there is no difference between a real Cloudflare log entry and a crafted one. The GhostJacking research demonstrates this at scale across multiple platforms that AI coding tools now routinely integrate with.

What Changed Between June and August

The June Agentjacking research was constrained to Sentry’s write-only DSN architecture. Sentry’s DSN is by design publicly embeddable, meaning essentially every organisation using Sentry has already exposed its attack surface to anyone who can inspect a page’s JavaScript source. That was one platform. That was 85%.

GhostJacking adds Cloudflare’s Logpush configuration and Datadog log ingestion to the attack surface. Cloudflare Logpush streams structured request logs, firewall events, and Workers invocations to configured destinations. Datadog accepts log data from a wide range of sources via its API. Both services are commonly integrated into AI coding agents through MCP servers or direct API connections, because developers want their agents to help debug infrastructure issues, triage alerts, and understand production anomalies from within their development workflow.

The practical implication: an attacker can inject crafted log entries into any of these three systems, and any AI coding agent that reads from them during a debugging or triage session will be exposed to those injected instructions. Tenet’s researchers achieved DNS record modification in their demonstrations — instructing the agent to update Cloudflare DNS settings using the developer’s already-authenticated CLI session. No separate Cloudflare credential needed. The agent does it.

The 15,000 Number

The jump from “100+ organisations” in June to 15,000+ in August reflects the expanded attack surface, not a new vulnerability class. When you add Cloudflare and Datadog to the Sentry exposure, you capture a much larger fraction of the modern development organisation population. These are among the most widely deployed observability and infrastructure platforms in the industry. Tenet’s estimate draws from the combined public exposure: organisations whose agents are configured to pull from any of the three services during live sessions.

The 90% success rate in their testing means the attack is not dependent on specific agent configurations or developer behaviours. It works across the range of typical setups. The 10% that didn’t convert involved cases where agents had been explicitly configured to refuse tool calls that weren’t in a pre-approved list, or where the organisation had disabled agent tool execution entirely.

What Agents Are Executing

In Tenet’s demonstrations at DEF CON, the GhostJacking payload variants achieved several distinct outcomes depending on what the agent had access to:

Credential harvesting from environment variables is the baseline capability, matching what Agentjacking demonstrated in June. Cloud API keys, GitHub tokens, database connection strings.

DNS record modification via authenticated Cloudflare sessions is the new demonstration. The agent uses the developer’s existing authenticated wrangler or cf CLI state to execute DNS changes the attacker specifies in the poisoned log content.

CI/CD pipeline manipulation through GitHub or GitLab API calls the agent already has access to. Modified workflow files, triggered deployments, added repository secrets.

Claude Desktop users got a separate disclosure: Tenet identified an exfiltration path in Claude Desktop that allows poisoned content to extract file system data through the application’s tool use. Anthropic patched this without issuing a CVE.

Why the Detection Gap Isn’t Closing

Defenders asking “can our security stack catch this?” are getting a consistently uncomfortable answer: not yet, not reliably. GhostJacking leaves no forensic footprint that distinguishes it from normal agent activity. The attacker touches only public write APIs. The agent executes only operations it was already permitted to perform. The log entry that triggered the behaviour looks structurally identical to legitimate log data.

SIEM rules that alert on anomalous API calls won’t fire because the calls aren’t anomalous. EDR that flags suspicious process execution won’t trigger because the terminal commands run from the developer’s own shell. Identity and access management controls don’t apply because the agent is using the developer’s own credentials.

The realistic defensive posture right now combines limiting what external services agents are permitted to read from during sessions, applying strict tool call approval workflows for any action that modifies infrastructure or credentials, and treating agent-initiated changes to DNS, CI/CD pipelines, and cloud resources as requiring explicit confirmation regardless of what the agent says prompted the change.

Tenet has published technical details on their blog. The DEF CON session recording is available through the DEF CON media archive.

---

References

• Tenet Security Threat Labs, “GhostJacking: Expanding AI Agent Exploitation Across Cloudflare, Datadog, and Sentry,” August 2026
• DEF CON 34 Talk, Tenet Security, August 9, 2026
• AI Security Wire, “Agentjacking: How Poisoned Sentry Events Hijack AI Coding Agents,” June 21, 2026
• SecurityWeek, “GhostJacking Attack Targets AI Coding Agents via Log Poisoning,” August 2026
• SC Media, “DEF CON: GhostJacking expands AI agent attack surface to 15,000 organisations,” August 2026