AI Agents Rewrite DNS Using Blocked Attack Data

A novel attack dubbed GhostJacking demonstrates how AI coding agents can be manipulated using logged, blocked attack payloads. Researchers at Tenet Security revealed that when firewalls block malicious requests, the payloads are stored in logs. AI agents reviewing these logs can interpret the attacker's text as valid instructions, leading to unauthorized system changes. Tenet's tests showed that Claude Code on Sonnet 4.6 successfully followed such instructions in nine out of ten attempts under standard Cloudflare configurations.

This vulnerability extends beyond Cloudflare, with public evidence found at 48 organizations, including six Fortune 500 companies. Similar exploits have been reported against Datadog and Sentry, where injection surfaces include alert or error reports. The core issue lies with AI agents that process attacker-reachable data and possess the ability to execute significant changes. A high prompt-injection block rate alone is insufficient as a security boundary.

Security leaders like Steve Wilson, co-lead for the OWASP Top 10 for LLM Applications, advocate for an 'authorization gate' outside the AI model. This gate would ensure that while an agent can propose changes, it cannot grant itself the authority to execute them. Such a system would route ambiguous or high-risk changes to human approval, preserving AI autonomy for investigations and routine tasks while preventing unauthorized infrastructure modifications.

Organizations are urged to inventory AI agents that read external data and can modify production systems. They should also implement containment sequences, such as denying outbound network access by default, and ensure all identities with production authority have clear ownership and expiry dates. The risk of AI agents executing unauthorized changes, as highlighted by GhostJacking, underscores the urgent need for robust governance and authorization mechanisms in AI deployments.