**New Research Exposes Identity Governance Gaps in AI Agents**
A recent demonstration at DEF CON 34 has highlighted a disturbing vulnerability in artificial intelligence (AI) agents, allowing attackers to manipulate and hijack these systems using seemingly legitimate security alerts and blocked events. This technique, dubbed “GhostJacking,” has left many organizations wondering if their AI-powered defenses are actually working against them.
Tenet Security, the company behind this research, demonstrated how attackers can poison content in trusted systems such as security alerts, logs, and error reports to trick agents into executing malicious commands. In one shocking example, researchers used a request that a Cloudflare firewall had blocked to trick an AI agent into modifying the company’s DNS settings, effectively taking over the domain. This attack relied on the fact that AI agents often struggle to distinguish between untrusted content they are processing and instructions they are supposed to follow.
This vulnerability is not limited to any single platform, as Tenet researchers demonstrated using Cloudflare, Datadog, and Sentry. The underlying attack pattern involves manipulating trusted data sources to trick AI agents into executing malicious actions. In another demonstration, researchers planted a fake diagnostic alert in Datadog that prompted an agent to execute attacker-controlled commands and steal environment secrets and cloud credentials.
The problem lies not in unauthorized access but in authorized access being used maliciously. Traditional identity controls are insufficient for AI agents because attackers can manipulate authenticated agents into abusing permissions they legitimately hold. To mitigate this risk, organizations must implement more robust identity governance measures specifically designed for AI agents.
According to Barak Sternberg, co-founder and CEO of Tenet Security, “An AI reads outside data it trusts, and the same AI can also act on it. Wherever those two things meet, the door is open.” To prevent such attacks, organizations should scope their AI agents to the minimum permissions they need, use short-lived credentials, and assume any token an agent can reach is already exposed.
The takeaway for organizations is clear: traditional identity controls are no longer sufficient in the age of AI-powered defenses. By implementing more robust identity governance measures and assuming that authorized access can be used maliciously, organizations can protect themselves against these types of attacks. As Sternberg warns, “It gets logged word for word, an analyst asks their agent to review the blocked events, and the block delivers the attack.” Don’t wait until it’s too late – take steps today to secure your AI-powered defenses.
Source: Dark Reading — 2026-08-10