{
  "entry": {
    "kind": "vuln",
    "slug": "ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the",
    "name": "ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the",
    "vendor": "No patchable",
    "description": "Tenet Security presented GhostJacking at DEF CON 34 on 9 August 2026, and the shape of it is worth sitting with, because the delivery channel is a security control working exactly as designed. An attacker sends a request crafted to be blocked, with the payload in a header such as User-Agent dressed up as scanner telemetry. The WAF blocks it and records it verbatim, which is its job. Later, an engineer asks a coding agent to review blocked traffic, the agent reads the log, and the recorded payload is now instructions in its context. The defensive record of the first attack becomes the delivery vehicle for the second. Tenet demonstrated it through Cloudflare, Datadog and Sentry - Cloudflare carries about a fifth of all web traffic and runs in 42 percent of Fortune 500 firms, Datadog in 48 percent, Sentry is used by around four million developers - and reported a 90 percent success rate against Claude Code on Cloudflare's own recommended configuration, with more than 15,000 organisations estimated exposed through vulnerable Cloudflare setups alone. The demonstrated chain ran the full length: initial access, privilege escalation, cloud credential theft and persistence, none of it tripping EDR, WAF or IAM, because every step was taken by an authorised agent using its own credentials. Tenet released an open-source mitigation called agent-jackstop alongside the talk, and separately disclosed a Claude Desktop sandbox escape that Anthropic confirmed and fixed before the presentation.",
    "website": "https://www.securityweek.com/ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-10",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the",
      "aliases": [
        "ti-092"
      ],
      "title": "GhostJacking: A Firewall Block Log Is an Injection Channel, Because the Agent Reads It Afterwards",
      "summary": "Tenet Security presented GhostJacking at DEF CON 34 on 9 August 2026, and the shape of it is worth sitting with, because the delivery channel is a security control working exactly as designed. An attacker sends a request crafted to be blocked, with the payload in a header such as User-Agent dressed up as scanner telemetry. The WAF blocks it and records it verbatim, which is its job. Later, an engineer asks a coding agent to review blocked traffic, the agent reads the log, and the recorded payload is now instructions in its context. The defensive record of the first attack becomes the delivery vehicle for the second. Tenet demonstrated it through Cloudflare, Datadog and Sentry - Cloudflare carries about a fifth of all web traffic and runs in 42 percent of Fortune 500 firms, Datadog in 48 percent, Sentry is used by around four million developers - and reported a 90 percent success rate against Claude Code on Cloudflare's own recommended configuration, with more than 15,000 organisations estimated exposed through vulnerable Cloudflare setups alone. The demonstrated chain ran the full length: initial access, privilege escalation, cloud credential theft and persistence, none of it tripping EDR, WAF or IAM, because every step was taken by an authorised agent using its own credentials. Tenet released an open-source mitigation called agent-jackstop alongside the talk, and separately disclosed a Claude Desktop sandbox escape that Anthropic confirmed and fixed before the presentation.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Credential theft",
        "Data exfiltration"
      ],
      "componentType": "agent",
      "component": {
        "name": "No patchable",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "No patchable version: any agent that reads WAF, APM or error-tracking output as trusted context. Demonstrated through Cloudflare, Datadog and Sentry, with a 90 percent success rate against Claude Code on Cloudflare's recommended configuration.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-10",
      "modifiedAt": "2026-08-10",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.securityweek.com/ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad/"
        }
      ],
      "mitigation": "There is nothing to upgrade, so the question to ask is which of your agents can read a log that an outsider can write into, and what that agent is allowed to do afterwards. Every one of those three products is an outsider-writable store by construction, so classify their output as untrusted input rather than as telemetry, and stop giving a triage agent the same token it would need to act on what it reads: separate the read path from the change path so reviewing blocked traffic cannot become changing DNS or reading a secret. Where an agent must be able to act, require human approval on the specific operations this chain needs - cloud configuration changes, credential reads, outbound network calls to new hosts - because the agent's own permissions are the entire blast radius here. Tenet's agent-jackstop is a reasonable starting point if you want the deny-by-default version of that. And note that this class will keep arriving under new names: any tool whose value is showing you what an attacker sent you is an injection channel into anything that reads it.",
      "detectedByAnomity": true
    }
  }
}