[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsUtbeoIwYgCTJD912r8jFk_s0FYzeF0xoqgrM9ICgvc":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"6a9d256e-9ee0-4cc7-8370-e6d682b2bbf0","‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad","ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad-b5619b","An AI agent executes instructions that an attacker has planted in the log or alert that records a blocked request word for word. The post ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad appeared first on SecurityWeek.","Tenet researchers demonstrated a 'Ghostjacking' attack where malicious instructions are planted in logs or alerts, tricking AI agents into executing them. This novel attack targets trusted platforms like Cloudflare, Datadog, and Sentry, leading to domain hijacking, code execution, and credential theft.","Ghostjacking attack uses poisoned logs to turn AI agents rogue.","https:\u002F\u002Fwww.securityweek.com\u002Fghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FArtificial-intelligence-AI.jpeg","2026-08-10T12:59:34+00:00","2026-08-10T14:00:14.726957+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Tenet","vendor",{"name":21,"type":19},"Cloudflare",{"name":23,"type":19},"Datadog",{"name":25,"type":19},"Sentry",{"name":27,"type":28},"Claude Code","product",{"name":30,"type":28},"Seer","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,59],{"type":56,"value":57,"context":58},"malware","Ghostjacking","Name of the AI hijacking attack demonstrated by Tenet.",{"type":56,"value":60,"context":61},"Agentjacking","Term used by Tenet for poisoning data fed to AI agents.",[18,21,23],{"controls":64,"vendors":144},[65,94,119],{"slug":66,"name":67,"problem":68,"products":69},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":51,"name":95,"problem":96,"products":97},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":115,"product_name":116,"url":117,"description":118},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"slug":120,"name":121,"problem":122,"products":123},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[124,130,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":120,"product_name":134,"url":135,"description":136},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":141,"url":142,"description":143},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[145],{"slug":146,"name":21,"logo_path":147,"roles":148},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[149],"affected",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":164},"poisoned-logs-hijack-ai-agents-in-ghostjacking-attack","Poisoned Logs Hijack AI Agents in 'Ghostjacking' Attack","The 'Ghostjacking' attack exploits a fundamental trust assumption: AI agents that consume logs, alerts, and monitoring data treat that data as authoritative instructions. By injecting malicious commands into log streams or alerts on platforms like Cloudflare, Datadog, and Sentry, attackers can manipulate AI agents into executing harmful actions including domain hijacking, arbitrary code execution, and credential theft. This is a form of prompt injection applied to operational pipelines, where the attack surface is the data the AI agent ingests rather than direct user input. As AI agents gain more autonomy over infrastructure, the integrity of the data they consume becomes a critical security boundary that most organizations have not yet hardened.",[155,156,157,158,159,160,161,162,163],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-53 AU-9: Protection of Audit Information","NIST AI RMF: GOVERN 1.2, MAP 5.1, MEASURE 2.5","OWASP LLM Top 10: LLM01 – Prompt Injection","MITRE ATLAS: AML.T0051 – LLM Prompt Injection",{}]