Two months ago this blog covered “agentjacking” — a Tenet Security disclosure showing that a public Sentry DSN was all it took to hijack Claude Code, Cursor, and Codex with an 85% success rate. Sentry called the flaw real but “not defensible” to fix at the root, because the thing that makes the attack possible (public DSNs accepting arbitrary error events) is also the thing that makes Sentry’s product work.
At DEF CON 34 on August 9, the same research team showed the problem was never really about Sentry. It’s about what AI coding agents are willing to believe.
The Same Attack, Three More Doors#
Tenet’s new disclosure, “Ghostjacking,” takes the exact mechanism behind agentjacking — plant instructions inside data an agent is told to trust, wait for a developer to ask the agent to investigate — and repeats it against Cloudflare’s blocked-request logs and Datadog’s diagnostic alerts, on top of Sentry’s error reports. Coverage from SecurityWeek and Infosecurity Magazine also names Splunk and Kubernetes as sharing the same exposure pattern, and Tenet reported the core findings to Cloudflare, Datadog, and Sentry back in June — meaning today’s talk is the public end of a two-month responsible-disclosure window, not a same-day surprise for the vendors involved.
The chain looks almost identical to June’s:
- An attacker crafts a log entry or alert that reads like a legitimate diagnostic message but carries injected natural-language instructions.
- The entry lands somewhere an AI coding agent is routinely pointed at — a blocked-request log, a performance alert, an error report.
- A developer, doing completely ordinary work, asks their agent to look into it.
- The agent pulls the poisoned entry through an MCP connection or API call and treats it as trusted system output, because that’s what tool output is supposed to be.
- The agent executes the attacker’s instructions with the developer’s own permissions.
What’s different this time is the number: under Cloudflare’s own recommended configuration, Tenet says the attack worked against Claude Code nine times out of ten. Cloudflare alone routes roughly 20% of internet traffic and is used by 42% of the Fortune 500; Datadog sits in 48% of Fortune 500 stacks and reportedly has 2,700+ API keys sitting publicly exposed on top of the log-poisoning path. Tenet’s estimate: more than 15,000 organizations exposed through vulnerable Cloudflare configurations alone, with roughly half of the Fortune 500 vulnerable across the combined platform set. Named-but-unidentified victims in the coverage include a trillion-dollar tech company, a global payments provider, and — pointedly — “a leading AI research lab.”
Why Nothing Alarms#
The framing Tenet used at DEF CON is the sharpest part of the disclosure: every step of a Ghostjacking chain is a legitimate, authorized operation. The agent has permission to read the log. It has permission to run the command the log appears to recommend. Nothing about the traffic pattern looks like an intrusion, because nothing about it is an intrusion in the way EDR software, a WAF, IAM policy, or a VPN gateway is built to recognize one. The firewall stays up, fully operational, and completely irrelevant — the attacker isn’t going around it, they’re walking through a door the organization’s own AI agent was handed the keys to.
That’s a genuinely different failure mode from the MCP security stories this blog has already tracked this year. May’s STDIO transport crisis (200,000 exposed servers) and the OAuth token hijacking disclosed the same month were both compromise-the-pipe problems — fix the transport, audit the dependency, patch the hole. Ghostjacking, like agentjacking before it, is a compromise-the-input problem: the pipe is working exactly as designed, and the poison rides in through data the agent was never going to question in the first place.
The Honest Part: Claude Code Wasn’t Spared#
It would be easy to write this up as a story about Cloudflare’s or Datadog’s exposure and leave Claude Code as a footnote. That would be dishonest. Claude Code was Tenet’s primary test subject, and a 90% success rate under a vendor-recommended configuration is not a rounding error — it’s a demonstration that the default posture most teams actually run in production doesn’t hold. Separately, Tenet also found and privately reported a distinct Claude Desktop vulnerability that Anthropic patched quietly, without a CVE, in a recent release — no public advisory, just a fix that shipped.
What makes the story worth Anthropic’s attention specifically is that the fix Tenet recommends isn’t hypothetical for Claude Code users — it already exists, and most people apparently aren’t turning it on. Tenet’s own open-source hardening tool, agent-jackstop, ships Claude Code configurations built entirely on primitives Anthropic has already shipped: deny-by-default network egress, sandbox.credentials blocking reads of .aws, .ssh, and .env files at the subprocess level, and a SKILL.md instruction that tells the agent to treat tool output as data, never as instructions. Tenet ranks deny-by-default egress as the single most effective control — it kills both the malicious fetch and the exfiltration beacon in one setting, regardless of how convincing the injected text is.
The uncomfortable read is that the architecture is arguably correct and the adoption isn’t there. A 90% failure rate against a “recommended” configuration means the gap between what Claude Code can enforce and what most Cloudflare-integrated deployments actually enforce is enormous.
What to Actually Do About It#
Turn on deny-by-default network egress now. This is Tenet’s top-ranked mitigation for a reason — it’s the one control that holds regardless of how good the next injected payload gets.
Enable sandbox.credentials. If your agent doesn’t need .env, .aws, or .ssh access to investigate a Cloudflare block or a Datadog alert, don’t let it have that access in the first place.
Add an explicit CLAUDE.md distrust rule for observability tool output. Not just Sentry anymore — Cloudflare, Datadog, Splunk, PagerDuty, Jira, and anything else your agent reads without a human first reviewing the content.
Require approval for command execution triggered by external data. An agent that can read a log and immediately act on what it read, unreviewed, is the exact shape of every step in this chain.
Audit what’s actually deployed, not what’s documented. The gap between “we have sandbox.credentials” in a settings file and “it’s actually enforced in the environment the agent runs in” is precisely what a 90%-under-recommended-config number is measuring.
No vendor — Cloudflare, Datadog, Sentry, or Anthropic — has published a public technical response to the Ghostjacking talk as of this writing, beyond Anthropic’s quiet, unrelated Claude Desktop patch. This is the fourth distinct MCP/tool-trust security class disclosed in 2026 after the STDIO crisis, OAuth token hijacking, and agentjacking itself. The pattern by now should be legible: every data source an agent is trusted to read is a trust boundary, whether or not anyone built it to be one.
Sources:
- SecurityWeek — ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad
- Infosecurity Magazine — “Ghostjacking” Exploits AI Agents’ Trusted Access to Evade Firewall Controls
- Cryptobriefing — Ghostjacking attack uses poisoned logs to compromise AI agents
- GitHub — tenet-security/agent-jackstop
- Tenet Security — One Fake Bug Report Hijacked a $250B Company’s AI Agent (background on the original agentjacking research)
- This blog’s prior coverage: Agentjacking: How a Fake Bug Report Hijacks Claude Code, Cursor, and Codex (2026-06-24)