AI Agents Hijacks Developer Machines

Overview

At DEF CON 34 in Las Vegas, researchers from Tenet Security unveiled a novel AI‑agent attack technique called Ghostjacking. This method allows attackers to hijack coding agents by embedding malicious instructions in seemingly benign data sources such as error logs, blocked requests, or monitoring alerts. Once processed by an AI assistant, these hidden commands can trigger unauthorized actions like changing cloud settings, stealing credentials, or creating persistent backdoors.

How Ghostjacking Works

• Indirect prompt injection: Instead of sending malicious commands directly, attackers embed harmful instructions in data the AI agent is likely to inspect.
• Trusted tool exploitation: Logs from Cloudflare, Datadog, or Sentry become delivery mechanisms for attacker‑controlled code.
• Authorized execution: Since the agent performs actions with legitimate permissions, traditional defenses like firewalls and identity systems struggle to detect the attack.

Demonstrated Attack Scenarios

• Cloudflare: Malicious requests blocked by the firewall were logged. When an AI assistant reviewed the logs, it executed attacker‑embedded instructions, modifying DNS settings and redirecting traffic.
• Datadog: Fake alerts crafted with exposed client‑side keys tricked AI agents into exposing environment variables and cloud credentials.
• Sentry (Seer AI): Crafted issue reports led Seer to generate attacker‑controlled recommendations. Other coding agents trusted Seer’s output, executing malicious fixes without reviewing the original content.
• Claude Desktop (patched): A sandbox escape flaw allowed data collected by an AI agent to leave its restricted environment, later remediated by Anthropic.

Why It Matters

Ghostjacking is particularly dangerous because:

• No malware required: The AI agent itself executes authorized actions.
• Stealthy persistence: Rogue accounts and backdoors can be created without triggering traditional alerts.
• AI‑to‑AI trust exploitation: Malicious outputs from one agent can cascade into another, amplifying the attack.

Defensive Guidance

Tenet Security recommends:

• Restrict AI‑agent network access by default.
• Require human approval before executing sensitive commands.
• Separate untrusted data from agent instructions.
• Review external tools and tokens used in AI workflows.
• Audit logs for unusual agent‑initiated actions.

Expert in the Cloud Insight

Ghostjacking highlights the new frontier of AI security risks: attackers no longer need to break authentication or deploy malware. Instead, they weaponize the trusted workflows of AI agents to execute malicious actions invisibly. For defenders, the lesson is clear: AI agents must be treated as privileged users, with strict guardrails, human oversight, and continuous monitoring of their interactions with external data.