The start-up Tenet Security presented a new attack technique against AI coding agents at the hacker conference DEF CON in Las Vegas. GhostJacking injects malicious commands through supposedly trusted log data from services like Cloudflare, Datadog, and Sentry. In tests against Claude Code, the attack had a success rate of nine out of ten attempts.
Firewall blocks the request, AI trusts the log anyway
GhostJacking does not target a software vulnerability but rather a structural pattern: AI agents that are allowed to read log data and execute commands in the same session. Firewalls reliably block malicious requests, but they log the thwarted attempt verbatim and without a trust marker. If a developer later asks the AI about the cause of an incident, the agent reads exactly this log entry and treats the instructions it contains as a legitimate order. To traditional security tools, the entire process looks like normal system work, because not a single step performs a prohibited action. According to Tenet Security, not a single conventional security tool flagged the takeover in any test case: neither endpoint protection nor web application firewalls nor identity and access management systems registered it. The Israeli start-up presented the technique on August 9, 2026, at the DEF CON hacker conference. A similar pattern had already been revealed by the attack technique GhostSplice, where prepared MCP servers led AI coding assistants to disclose access credentials – GhostJacking, however, shifts the entry point from tool calls to ordinary observability and logging services.
Attack on Claude Code succeeds nine times out of ten
In the central test scenario, Tenet Security ran the attack against Claude Code, configured according to Cloudflare’s recommended default setup. The success rate was nine out of ten attempts, even though every single malicious request had been correctly rejected beforehand. The full attack chain, according to the researchers, reaches from the developer laptop all the way into a company’s core infrastructure: through compromised logs, attackers first gain access, then expand it to connected systems, and even move laterally between multiple AI agents. In the process, the researchers used the analysis tool Seer from Sentry’s own AI offering as a springboard: a coding agent accepted its output as trustworthy without verification, even though the underlying event data had itself been manipulated. During the research, Tenet Security also discovered a vulnerability in Claude Desktop’s JWT validation that allowed the application’s sandbox to be bypassed. Anthropic reviewed, confirmed, and closed the gap before the research findings were published, according to the start-up.
More than 15,000 companies worldwide potentially affected
It is not the three named providers themselves that are vulnerable, but their sheer prevalence as a data source for AI agents. Cloudflare says it handles roughly a fifth of global web traffic, Datadog counts nearly half of the Fortune 500 among its customers, and around four million developers use Sentry for error tracking. Tenet Security reported the underlying vulnerabilities in the log formats to Datadog on June 17, 2026, and to Sentry on July 13, 2026; public responses from either provider are still pending. The start-up says it has identified more than 2,700 organizations with confirmed vulnerable configurations, including a Fortune 500 technology company and a lab from AI research. The estimated total number of at-risk companies stands at more than 15,000, according to Tenet Security – a figure that has not been independently verified. Anyone working with Claude Code, Gemini CLI, or similar agents while feeding in Cloudflare, Datadog, or Sentry logs should, for now, treat requests to these services as fundamentally untrustworthy, regardless of whether a firewall blocked them beforehand.
It remains an open question whether Cloudflare, Datadog, and Sentry will add binding trust markers to their log formats before the technique surfaces outside controlled test environments. GhostJacking joins the zero-click flaw PleaseFix in AI browsers in a growing list of similar cases, and it shows that companies running AI agents in production need their own rules for which data sources those agents are allowed to trust in the first place.
