A newly demonstrated attack technique, called GhostJacking, can turn a company's own AI coding agent into a tool for hijacking its DNS, according to security firm Tenet Security. The attack was shown on the DEF CON 34 main stage on August 9. In Tenet’s benchmark, Claude Code on Sonnet 4.6 followed a malicious instruction embedded in a blocked web request in nine out of ten attempts, even when the company used Cloudflare’s recommended security configuration. Tenet found public evidence of the vulnerable setup at 48 organizations, including six confirmed Fortune 500 companies.
The attack chain begins when a request containing a prompt-injection payload is blocked by a firewall and logged. An AI coding agent that reviews those logs reads the attacker’s text as a legitimate instruction and acts on it using credentials issued to the agent months earlier. No security control fails in this process: the firewall works, and every action taken by the agent is authorized. The issue is architectural, meaning no single platform patch eliminates the risk for any agent that reads attacker-reachable data and can independently execute high-impact changes.
Steve Wilson, Chief AI and Product Officer at Exabeam and co-lead for the OWASP Top 10 for LLM Applications, recommends placing an authorization gate outside the model. Under this design, an agent can propose a specific change, but it cannot grant itself the authority to make it. A policy check in code approves safe, clearly defined changes automatically, while anything ambiguous or high-impact is routed to a named human for approval. Wilson stressed that security rules written inside prompts are merely suggestions to the model, not enforceable controls.
The attack was demonstrated live using the Cursor coding agent, which read data through a GraphQL integration and wrote through the Cloudflare API. The agent ingested a poisoned header, patched a DNS A record, and added a CNAME record, giving an attacker a path to reroute web and email traffic. In a separate test against Sentry, a coding agent escalated a crafted error report to Sentry’s own AI, Seer, which had absorbed the attacker’s proposed fix. The coding agent followed Seer’s recommendation, bypassing Sentry’s own written rule that agents should never follow directives found in event data.
The 2026 OWASP Top 10 for LLM Applications, published August 4, elevated “Excessive Agency” three places on its list, the largest upward move. The ranking blended a 75% practitioner vote with incident data from 6,639 documented cases. Tenet co-founder and CEO Barak Sternberg told Dark Reading that the firewall never went down, it just stopped mattering. His suggested fix is to split what an agent can read from what it can execute, and he acknowledged the cost, because an agent that reads alerts but cannot act on them is not the agent most companies deployed.
Kayne McGladrey, a senior member of the IEEE, said he has not seen any Fortune 500 company implement a hard governance threshold with a named human holding a kill switch and a rollback mechanism. He believes companies are accepting the risk, either deliberately or unconsciously, betting that the advantage outweighs the penalty. He argued that behavior would change only if consequences outweighed the perceived benefits. He also noted that a system in the inference layer may not report its own shortcuts and could lie about having cheated, so it should not authorize its own actions.
Industry data shows the sector is not prepared for this split. Ivanti’s 2026 State of Cybersecurity Report found that 77% of security professionals are at least somewhat comfortable letting AI act without human review. CrowdStrike’s prompt-injection taxonomy passed 200 techniques in July, naming indirect injection through data an agent reads as the critical vector. The proposed fix does not eliminate autonomous investigation or routine, bounded remediation, but it removes the path from an attacker’s text to unreviewed production authority.
More AI news from TechManNews.
