A new attack technique called Ghostjacking exploits AI coding agents to bypass firewall defenses at major corporations, according to research presented at DEFCON 2026 by Tenet Security. The vulnerability affects approximately half of Fortune 500 companies that use AI agents with access to their code and infrastructure. Researchers demonstrated the attack succeeds nine out of 10 times against popular AI coding assistants, turning organizations' own security tools into delivery mechanisms for attacks.
The attack represents an evolution of the Agentjacking technique, which tricks AI coding agents into executing arbitrary code. Ghostjacking works by planting malicious instructions in system logs, error reports, or alerts that AI agents routinely read. When security analysts ask their AI assistants to review blocked requests or check for errors, the agents read these planted instructions as legitimate findings and execute them. The firewall remains operational but becomes irrelevant because the AI agent uses its already-granted access to carry out the attack.
Tenet researchers demonstrated multiple attack vectors across widely used platforms. With Cloudflare firewalls, blocked malicious requests are recorded word-for-word in logs. When an AI agent reviews these logs, it reads the attacker's planted instructions and can rewrite company DNS settings to redirect traffic. On Datadog, researchers found over 2,700 publicly exposed API keys that allowed them to plant fake diagnostic alerts. With Sentry, attackers exploited the platform's own AI assistant, Seer, to validate malicious code to other agents. The pattern affects platforms including Splunk and Kubernetes configurations.
The attack succeeds because AI agents cannot distinguish between legitimate instructions and traps hidden in data they process. Attackers can establish persistent access by leaving backdoors in agent configurations, memory, and connected tools. Researchers even demonstrated a self-exploit technique where one AI agent builds an attack that another AI automatically accepts. The vulnerability is particularly serious because it generates no alerts for security teams, as agents use their existing authorized access.
Tenet reported the findings to affected vendors in June and recommends several mitigation steps. Organizations should deny outbound network access by default to prevent unauthorized downloads and data exfiltration. Companies must require human approval for any commands AI agents want to execute and ensure data read by agents never becomes executable instructions. Security teams should treat any accessible API token as potentially compromised and audit all tools connected to AI agents. These controls can significantly reduce exposure while organizations continue using AI assistance for development tasks.
Source: https://www.infosecurity-magazine.com/news/ghostjacking-ai-gents-access/