Ghostjacking can hijack AI coding agents

Published July 28, 2026

Ghostjacking can trick AI coding agents into treating attacker-controlled text in logs, alerts, or reports as instructions. With existing permissions, an agent could change DNS settings, redirect traffic, or expose credentials.

Report priority
Medium
Targets
Cloudflare+2 more

How it works

  • An attacker places instructions inside data that an AI agent is asked to review.
  • That data can come from blocked web requests, monitoring alerts, or issue reports.
  • The agent may mistake the text for a trusted task and use its existing permissions.
  • The supplied evidence does not establish every step required for each demonstrated integration.

What to do

Review which AI coding agents can read Cloudflare logs, Datadog alerts, or Sentry issues, then list the actions and secrets those agents can access. The supplied evidence does not establish an exact affected version or a reliable built-in exposure check.

Restrict agent network access by default and require human approval before commands run. Separate untrusted data from agent instructions, and review every external tool and permission connected to the workflow.

Technical details

Affected software: Cloudflare, Datadog, Sentry

Ghostjacking is an indirect prompt-injection technique. Attacker-controlled text enters trusted monitoring or issue data, then an AI agent may interpret it as an instruction and perform authorized actions.

References

View Original Source