GhostJacking Attacks: AI Agent Takeover via Firewall Evasion

What it is

Tenet Threat Labs' "Ghostjacking" (DEFCON 34, Aug 9 2026) — a four-part agentic kill chain that hijacks AI coding agents (Claude Code, Cursor) through the observability/CDN platforms they're wired into. The summary names the primitives; what it omits is the exact vulnerable pattern, the tool/field names, disclosure dates, and the mitigation's actual contents.

How it works

Every chain reduces to one shape: a read-only data tool and a write/exec tool share a single agent session, and a log field crosses into the model with no provenance tag. The agent can't distinguish trusted instruction from attacker-planted data, then acts on it.

• Cloudflare (90% vs Claude Code / Sonnet 4.6): The default Managed Ruleset blocks a path-traversal body and logs it to firewallEventsAdaptive, storing User-Agent/Referer byte-for-byte. The payload rides in User-Agent; the blocked body is never shown to the agent, so it reads the header as innocent metadata. GraphQL MCP reads analytics, API MCP's execute writes — both in one session. What worked was structured scanner telemetry (ticket ref, compliance citation, unfalsifiable metric), not imperatives — those were refused. The payload anchors in truths the agent self-verifies (subdomain DMARC missing, parent sp=reject), then the agent trusts attacker-supplied rua/CNAME values and patches DNS with no confirmation.
• Datadog: Write-only client token leaks in page source and CSP/Reporting-Endpoints headers (2,700+ found via passive recon). search_datadog_logs/get_log_event_details return message verbatim; a "diagnostic required" fake triggers an npx RCE. Disclosed June 17 2026.
• Sentry (agent-to-agent): Crafted events (≥10, no stack trace) score ~0.6 on Seer's fixability metric, above the 0.40 escalation floor; an XML breakout in a breadcrumb makes Seer adopt the attacker's npm package as its own finding, which the coding agent then installs. Disclosed July 13.
• Claude Desktop zero-day (JWT cross-reuse): Envoy egress proxy validates the JWT signature and allowed_hosts claim but never binds it to container_id/session. An attacker widens the allowlist in their own instance, extracts the token, and via injection makes the victim's agent present it — full egress bypass. Patched by Anthropic, no CVE.

What to do

Deploy agent-jackstop (github.com/tenet-security/agent-jackstop), drop-in hardening for Cursor and Claude Code:

• Deny outbound network access by default (breaks the download and exfil).
• Require human approval for any command the agent runs.
• Never let data an agent reads become an instruction it runs.
• Treat any reachable token as compromised; review every connected tool.

flowchart LR
  A[Poisoned log field<br/>verbatim, no provenance] --> C{Read tool + write tool<br/>in one session?}
  C -->|yes| D[Agent acts on attacker data<br/>DNS hijack / RCE / vouch]
  C -->|no| S[Chain broken]
  D --> E[JWT cross-reuse<br/>egress bypass = exfil]
  M[agent-jackstop:<br/>deny egress, approve cmds] -.cuts.-> E

Caveats

The 15,000+ exposure figure is extrapolated from 73 artifacts across 48 orgs — adoption of the vulnerable setup, not confirmed breaches. Tenet states agent-jackstop "won't solve this completely." All testing used the researchers' own accounts; no customer data touched.