Half of Fortune 500 companies are vulnerable to a new class of attack that uses an organization’s own AI agents to route email and web traffic around its firewall, Tenet Security told DEFCON on August 9, 2026.
How Ghostjacking turns trusted AI agents into covert delivery systems
Tenet Security researchers call the technique "Ghostjacking." It begins with a seemingly benign data artifact — for example, a fake bug report or a planted log entry — and ends with an AI agent, trusted and authorized inside the corporate perimeter, executing attacker-supplied instructions. Because the agent is using credentials and access it already holds, the activity cannot be flagged by defenders as coming from an untrusted source. The firewall itself remains operational but is rendered irrelevant when the organization’s own agents reroute traffic.
In one demonstration, Tenet showed that a single fake bug report could hijack AI coding assistants and execute attacker code on a developer’s machine. The researchers warned that attackers can leave backdoors in an agent’s configuration, memory and tools, creating persistent access for data and credential theft.
Cloudflare, Datadog and Sentry: the same shape, different panels
Tenet emphasized that the same structural pattern underlies exposures in multiple vendor platforms. With Cloudflare, a managed security rule that blocks a malicious request records the blocked request word-for-word in logs. When an analyst asks an AI to review blocked events and the AI reads that planted log, it treats the content as a real finding and can rewrite DNS to point the domain at the attacker. "It is Cloudflare’s managed security rule that blocks the request, and that block is what carries the attack in," Tenet said.
Datadog’s exposure stems from front-end keys that are routinely left public; Tenet located more than 2,700 of these keys. Those keys can be used to plant fake "urgent diagnostic alerts" that a coding agent will read and act on. With Sentry, Tenet demonstrated a further twist: Sentry’s own AI, Seer, can read a fake report and a malicious "fix" and vouch for that outcome to the next agent, which then executes the malicious code. "Sentry, Cloudflare, and Datadog are not three separate flaws. They are the same shape," the researchers said.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDEFCON 2026: demonstrations and success rates
The findings were presented on the main stage at DEFCON 2026 in Las Vegas on August 9. Tenet’s team showed the technique across common developer platforms and cloud setups, noting the pattern also appears in combinations such as Splunk with a build system or Datadog with Kubernetes. Against the Claude Code AI agent running on Cloudflare’s own recommended setup, the attack chain succeeded nine out of 10 times in the Tenet demonstration.
Tenet reported the findings to Sentry, Datadog and Cloudflare in June. The company also highlighted how widespread the dependency on the implicated products is: Cloudflare runs in 42% of Fortune 500 firms and carries a fifth of all internet traffic; Datadog runs in 48% of those companies; and Sentry is used by four million developers. Tenet summarized the practical stakes plainly: increasingly, organizations are entrusting AI agents with full access to code and infrastructure, while the agents cannot reliably distinguish a real instruction from a trap hidden in the data they read.
Tenet’s hardline mitigation checklist for defenders
- Deny outbound network access by default — Tenet says this alone stops the attacker’s download and the data leak.
- Require a human to approve any command the agent wants to run.
- Never let data an agent reads become an instruction it runs.
- Assume any reachable token is at risk, and review every tool the agent connects to.
What this means for technologists, procurement leaders, and end users
Technologists and security teams will be pushed to change default architectures: deny-by-default outbound policies, mandatory human approvals for agent actions, and systematic reviews of tokens and tool integrations are Tenet’s explicit recommendations. Teams that allow agents to act automatically on logs or alerts are the most immediate targets.
Procurement leaders and architects face a supply-chain decision: several common vendor setups — including Cloudflare’s recommended configuration — were directly tested and found vulnerable at scale. Given Tenet’s measurements of product prevalence in the Fortune 500 and the finding of more than 2,700 exposed Datadog keys, buyers must evaluate how vendor defaults and recommended configurations treat logs, keys and agent integrations.
End users and enterprise owners should watch the specific risks Tenet demonstrated: an attacker who succeeds can quietly reroute website traffic and email by altering DNS, or establish persistent backdoors in agent configurations and memory that allow credential and data theft without immediately triggering classic firewall alerts.
Tenet’s demonstrations and recommendations place a clear set of choices before organizations that have folded AI agents into core development and operations workflows. Either those agents are constrained — outbound access limited, human approvals required, tokens assumed hostile — or the agents themselves become trusted vectors that bypass perimeter controls.
