Ghostjacking
Named by 2 kept items in this workspace.
Search every workspace for Ghostjacking. It matches the name as written, so it can find other things that share it.
The items that name it 2
Uses a WAF's own block log as a delivery channel: blocked traffic is logged with attacker payload intact, and an agent later asked to review the log executes the payload as instruction rather than evidence; chains reach DNS record modification, cloud credential theft, and cross-agent lateral movemen
Term coined by Tenet for attacks that run entirely on actions an AI agent is already authorized to take (internal agent tools/actions), requiring no code execution or rule-breaking, so nothing trips an alarm; composed of initial access, escalation, exfiltration, and persistence stages
All techniques in this workspace.