The Illusion of a Secure Perimeter
Your firewall is up. Logs are clean. The bad guys are outside. That’s the comfortable story — and it’s exactly what a new attack technique called Ghostjacking exploits.
Half of the Fortune 500 runs setups that could be silently gutted by their own AI coding agents, according to research from Tenet Security presented at DEFCON 2026 in Las Vegas on August 9. The trick isn’t breaking in. It’s making the company’s own trusted tools open the door from the inside.
The researchers showed how a single fake bug report can hijack an AI assistant, reroute email and web traffic, and leave a backdoor that survives cleanup. The firewall doesn’t even go down. It just becomes irrelevant.
How Ghostjacking Works: A Fake Report Becomes a Real Command
Here’s the core problem: AI agents can’t tell the difference between a genuine instruction and a trap hidden in data they’re told to read. Tenet calls this the next evolution of the ‘Agentjacking’ attack class, where coding assistants are tricked into running arbitrary code.
The attack chain is deceptively simple. With Cloudflare‘s firewall, when a malicious request is blocked, the system logs it word-for-word. An attacker plants a fake log entry. Later, when an analyst asks the AI to review blocked events, the agent reads that planted entry as if it were a real finding. The AI then rewrites the company’s DNS, points the domain at the attacker, and reports the issue as resolved. Traffic and emails quietly reroute.
“It is Cloudflare’s managed security rule that blocks the request, and that block is what carries the attack in,” Tenet said.
Datadog and Sentry: The Same Shape, Different Doors
The pattern repeats elsewhere. Datadog keys meant only for front-end use are routinely left public — Tenet found over 2,700 of them. Those keys let an attacker plant a fake “urgent diagnostic alert” that the AI agent reads when an engineer asks it to check for errors.
With Sentry, the researchers went further. They used Sentry’s own AI, Seer, to vouch for their fake fix. Seer reads the planted report and the attacker’s malicious patch, then presents it as its own conclusion to the coding agent. The agent trusts Seer, runs the code, and the machine is compromised.
“Sentry, Cloudflare, and Datadog are not three separate flaws. They are the same shape,” the researchers noted. “An AI reads outside data it trusts, and the same AI can also act on it. Wherever those two things meet, the door is open.”
The Scope: Why This Matters for Fortune 500 Companies
The exposure isn’t hypothetical. Cloudflare runs in 42% of Fortune 500 firms and carries a fifth of all internet traffic. Datadog is present in 48% of those companies. Sentry is used by four million developers.
Tenet demonstrated the technique succeeded nine out of ten times against the Claude Code AI agent, on Cloudflare’s own recommended setup. Among the organizations running that exact exposed configuration are a trillion-dollar global tech company, a major payments provider, and a leading AI research lab.
The attack also leaves persistent access. Attackers can embed backdoors in the agent’s configuration, memory, and tools — enabling data theft, credential harvesting, and long-term espionage. In one demonstration, the team even got one AI agent to build an attack that another AI would accept. They called it a “self-exploit.”
What Companies Can Do Right Now
Tenet reported the findings to Sentry, Datadog, and Cloudflare in June. But the researchers stress that patching these specific platforms won’t end the problem. The underlying flaw — AI agents trusting external data — is structural.
They recommend four concrete actions to reduce exposure:
- Deny outbound network access by default. This alone stops both the attacker’s download and the data leak.
- Require human approval for any command the agent wants to run.
- Never let data an agent reads become an instruction it runs. Separate input channels from execution channels.
- Assume any reachable token is at risk. Review every tool the agent connects to, and rotate credentials aggressively.
The uncomfortable truth is that AI agents are being handed keys to the kingdom — and they can’t tell a legitimate order from a poisoned log entry. Until that changes, the firewall is just a decorative wall.
