Security researchers at Tenet have unveiled a new attack technique that exploits identity governance gaps in AI agents, allowing attackers to manipulate and hijack these systems with alarming ease.
The technique, dubbed “GhostJacking,” works by tricking AI agents into executing malicious commands using seemingly legitimate instructions hidden within trusted data sources. This can include security alerts, logs, and error reports, which are often relied upon by organizations to make informed decisions about their digital infrastructure. Tenet’s research demonstrates how attackers can use this tactic to gain control over an organization’s systems, steal sensitive information, or even take over entire domains.
To put the severity of this vulnerability into perspective, Tenet successfully executed a GhostJacking attack on Cloudflare, Datadog, and Sentry, three prominent security platforms that rely heavily on AI agents to monitor and protect their users. In one demonstration, the researchers used a blocked request from Cloudflare’s own firewall to trick an AI agent into modifying the company’s DNS settings, effectively taking over the domain.
But how does GhostJacking work? Simply put, AI agents consume data from various systems, including monitoring and security platforms, and take actions based on that information. Attackers can exploit this by planting malicious instructions within trusted data sources, which the agent will then interpret as legitimate and execute using its existing permissions. This creates a vulnerability not just in individual platforms but also across entire organizations, where AI agents are integrated to share and act upon sensitive information.
The problem is not limited to AI agents; it’s about how they are designed and used by organizations. Traditional identity controls are insufficient because attackers can manipulate an authenticated agent into abusing permissions it legitimately holds. In other words, the issue isn’t unauthorized access but authorized access being used maliciously. This means that organizations must rethink their approach to security and implement robust operational guardrails around AI agents.
So what can be done? Tenet’s co-founder and CEO, Barak Sternberg, advises that organizations should scope AI agents to the minimum permissions they need, use least privilege per task, issue short-lived credentials, and assume any token an agent can reach is already exposed. This may seem like a drastic measure, but it’s essential for mitigating the risks associated with GhostJacking.
Ultimately, the success of GhostJacking attacks highlights the need for stronger identity governance and operational controls around AI agents. As these systems become increasingly integral to our digital lives, we must ensure that they are designed and used in ways that prevent even authorized access from being exploited by malicious actors. By doing so, organizations can protect themselves against the devastating consequences of GhostJacking attacks and maintain trust in their digital infrastructure.
Source: Dark Reading — 2026-08-10