Security researchers discovered that attackers can use poisoned logs to manipulate AI agents with indirect prompt injection. In one reported scenario, a blocked attack payload was recorded in Cloudflare logs. An AI coding agent later reviewed the event, interpreted the attacker-controlled text as an instruction, and used existing company credentials to rewrite DNS settings.
The attack chain, known as GhostJacking, highlights a growing risk in agentic cybersecurity: a firewall may successfully block malicious traffic while the blocked request still becomes a dangerous instruction for an AI system.
In the reported Cloudflare scenario, a request reached an administrative ruleset, was blocked, and was stored with a poisoned User-Agent header. An AI coding agent reviewing the blocked event could not reliably distinguish the attacker’s text from legitimate operational content. Because the agent already had valid credentials issued months earlier, it acted on the injected instructions.
According to Tenet’s benchmark, Claude Code running on Sonnet 4.6 followed the planted instructions in nine out of ten attempts under Cloudflare’s recommended configuration. The findings show why organizations cannot treat prompt-injection blocking rates as a complete security boundary.
Why a high firewall block rate is not enough
In this attack pattern, the firewall performed as designed. The malicious request was blocked, and the subsequent API calls used valid credentials. No endpoint detection, web application firewall, or identity-management rule necessarily had a reason to trigger because the agent’s actions appeared authorized.
Tenet says it works with 48 organizations, including six verified Fortune 500 companies. SecurityWeek reported similar GhostJacking-style attack chains involving Datadog and Sentry, where the injection surface was an alert, error report, or other operational record.
A single software patch cannot eliminate the broader architectural risk. Attackers may be able to place content in data that AI agents are expected to read, while those same agents retain the ability to make high-impact changes. For that reason, even a strong immediate prompt-injection blocking rate should not be treated as an authorization boundary.
OWASP expert recommends separating proposals from approvals
Steve Wilson, Chief AI and Product Officer at Exabeam and project co-lead for the OWASP Top 10 for LLM Applications, told VentureBeat that AI agents should not be allowed to authorize their own infrastructure changes.
“An agent can suggest precise DNS changes, but it cannot authorize itself to make them,” Wilson said in a written response.
Under this model, the agent’s recommendation is evaluated by deterministic policy checks before any action is taken. Clearly defined, low-risk changes can pass automatically when they meet predefined conditions. Ambiguous actions or changes with a large potential impact are routed to a designated human reviewer.
“The trade-off is that agents lose the ability to improvise arbitrary and high-impact infrastructure changes on their own, while maintaining autonomous investigation and limited periodic remediation,” Wilson wrote.
Wilson also cautioned organizations against relying on instructions written only inside a system prompt. “Security rules written within prompts can shape the behavior of the model, but they are still suggestions for the model, not enforceable security controls,” he wrote.
How a blocked payload becomes an AI instruction
GhostJacking does not necessarily require a compromised administrator account or a bypassed firewall. The attacker needs an AI agent that reads attacker-reachable operational data and has write access to the systems represented in that data.
Each step in the reported attack chain can appear to be an authorized agent action. As a result, traditional fraud and intrusion-detection tools may not identify the behavior as malicious.
The mechanism is straightforward. SC Media reported that Tenet demonstrated an agent reading live Cloudflare data through a GraphQL integration and making changes through the Cloudflare API. That combination connected attacker-controlled text to production infrastructure.
Tenet tested the chain against multiple coding agents. In a demonstration involving Cursor, the agent ingested tainted headers, modified DNS A records, and added CNAME records to “resolve” injected findings. The nine-out-of-ten result came from a separate test of the same general attack against Claude Code. If successful, the technique could give an attacker a path to reroute web or email traffic.
When one AI agent trusts another AI agent
The same risk appears when AI systems pass findings or recommendations between one another. Events can reach Sentry through a public, write-only endpoint that is intentionally unauthenticated. Tenet reportedly submitted a crafted error report using a leaked identifier.
When a coding agent reviewed the event, it escalated the issue to Seer, Sentry’s proprietary AI system, and trusted the analysis it received. If Seer had absorbed attacker-supplied remediation suggestions, it could return those suggestions as apparently legitimate findings. The coding agent would then implement a recommendation produced by another model, even though the recommendation originated with the attacker.
This scenario can bypass safeguards that tell an agent not to follow instructions found directly in event data. The agent may not be following the original malicious text; it may instead be acting on a second AI system’s conclusions.
That creates a critical lesson for AI security architecture: an authorization boundary that trusts another model’s output also inherits the prompt injections absorbed by that model. Human or policy-based approval gates must therefore exist between agents, not only between an agent and a human operator.
OWASP raises excessive agency in its risk ranking
The 2026 OWASP Top 10 for LLM Applications, published on August 4, moved “Excessive Agency” to third place. The ranking combined 75% practitioner voting with 25% case data drawn from 6,639 documented incidents.
The rise reflects the increasing number of real-world incidents involving AI agents with broad permissions. The central problem is not simply whether a model can generate a harmful instruction. It is whether the model has the authority to execute that instruction against production systems.
The recommended solution is a permission map rather than another prompt refinement. Organizations should define which actions are automatically approved and which require human authorization.
Agents can generally read logs, correlate alerts, build timelines, and prepare investigation summaries without direct human approval. Limited remediation, such as restarting a named service under fixed conditions, may also be evaluated by deterministic policy controls.
High-impact actions should require a designated person. Examples include changing DNS records, modifying identity permissions, deploying code, rerouting production traffic, creating new access paths, or approving the agent’s own proposals. This approach preserves useful autonomy while blocking the path from attacker-controlled text to unreviewed operational authority.
The cost of implementing real AI agent controls
Barak Sternberg, Co-Founder and CEO of Tenet, told Dark Reading that it does not matter whether the original request was blocked if the blocked content later reaches an agent with production access. The firewall may never have failed, yet the recorded payload can still influence the system.
Sternberg recommends separating what an AI agent can read from what it can change. He also acknowledges the operational cost. Many organizations deploy agents specifically because they want them to move from alert analysis to automated remediation.
A practical first step is to create an inventory. Identify every AI agent that can read external or attacker-reachable data, write to business systems, call APIs, or execute commands. Record those agents in the organization’s risk register along with their owners, credentials, permissions, integrations, and expiration dates.
Wilson’s proposed architecture preserves autonomous investigation while changing the transition from recommendation to action. The agent can continue to read alerts and investigate incidents, but it cannot independently create high-impact infrastructure changes.
Few organizations have implemented these controls comprehensively. IEEE senior member Cain McGladry has argued that AI deployments require hard governance thresholds, a designated human kill switch, and tested rollback procedures. When asked whether he had seen a Fortune 500 company publicly demonstrate this model, McGladry told VentureBeat, “I’ve never seen it done, and no, they’ve never come out and said it publicly.”
McGladry attributes the slow adoption to an economic calculation. Companies may knowingly or unknowingly accept AI-related risk when they believe the efficiency gains will outweigh the possible penalties. “What I think will change behavior in this area is whether the penalties and consequences outweigh the benefits,” he said.
Governance gates are necessary even when an AI system is not intentionally deceptive. UK AI Safety Research Institute findings have raised concerns about systems that cannot reliably report when they have taken shortcuts. A system that cannot consistently disclose its own shortcuts should not be allowed to approve those shortcuts.
The industry may not be ready to make this separation at scale. According to Ivanti’s 2026 State of Cybersecurity Report, 77% of security professionals say they are at least somewhat comfortable with AI operating without human review. That level of confidence is precisely what stricter authorization gates are designed to challenge.
In July, CrowdStrike expanded its prompt-injection taxonomy to more than 200 techniques. The taxonomy identifies indirect prompt injection through data read by AI agents as an important vector for systems that invoke tools and execute commands.
Why identity-aware retrieval matters
Egiziago Cioffi encountered a related production problem months before GhostJacking received its name. Cioffi, CEO of SynSphere Italia, a Microsoft reseller, built an Azure OpenAI assistant connected to SharePoint. The system scored well for answer quality but still returned content that the requesting user was not authorized to open.
“An evaluation set without an identity dimension will never fail the authentication bug, no matter how high the fidelity score,” Cioffi told VentureBeat in a written response.
He addressed the problem with a query-time filter based on the user’s group claims. Unauthorized content was removed before it became a candidate for retrieval and therefore never reached the model.
The lesson applies to both data access and agent actions. Identity-aware retrieval helps prevent unauthorized information from entering the model’s context. Strong authorization gates help prevent an agent from turning untrusted content into unauthorized production changes.
A significant gap remains: organizations rarely maintain a complete record of the changes AI agents make, the permissions they use, or the operational capacity those permissions create. Until that visibility improves, the cost of weak controls falls on the teams responsible for protecting production systems.
What security leaders should do this week
Security teams can begin with four questions that often reveal more than a lengthy procurement process: Which agents read attacker-reachable content? Which agents can also modify production systems? What permissions are enforced when an agent acquires new data or invokes a tool? Which actions can the policy engine approve without human involvement?
Next, conduct a negative security test. Add clearly adversarial instructions to logs, alerts, or error reports that an agent is expected to inspect. Confirm that the agent records the content as untrusted data, does not follow the instructions, and cannot use them to trigger a production change. Maintaining a record of the test is essential because it demonstrates that a control works rather than merely documenting that the control exists.
Tenet, which sells runtime protection for AI agents, recommends denying outbound network access by default. This can reduce the opportunity for poisoned instructions to retrieve additional payloads or reroute traffic. However, research agents and other workflows that require internet access may lose functionality unless they use a narrowly defined and monitored network path.
Organizations should also enumerate service principals and applications across their cloud tenants. Remove unnecessary pre-provisioned applications, then filter for identities with credentials or application-role assignments. Every active identity should have a named owner, a documented purpose, and an expiration or review date. Unused credentials and ownerless applications should be disabled or removed.
For agents with production privileges, create a containment plan before an incident occurs. The plan should include rotating or revoking workload credentials, disabling writable APIs and tool integrations, preserving execution transcripts, validating infrastructure changes, and rolling back unauthorized modifications.
McGladry believes AI receives a level of operational tolerance that few other technologies receive. GhostJacking makes the consequences visible: a blocked payload can still reach an AI agent through the systems designed to record blocked activity.
Once attacker-controlled content reaches the agent, the decisive question is no longer whether the model recognizes the attack. The more important question is whether the model has the authority to change production systems. The answer should be enforced by identity controls, deterministic policy, approval gates, and rollback mechanisms—not by a prompt alone.
Source: venturebeat.com