The fix for the AI agent that hijacked a company's DNS
Louis Columbus
9:13 am, PT, August 26, 2026
VentureBeat created with Gemini
A security agent, after reading a Cloudflare log, misinterpreted an attacker’s prompt-injection payload as instructions, leading it to rewrite the company’s DNS settings. Although a firewall had blocked this payload, its details were recorded in the log. This phenomenon is known as GhostJacking, demonstrated by Tenet Security at DEF CON 34.
The agent, after reviewing blocked events, identified and executed the attacker's text as instructions, believing it to be legitimate due to the similar formatting with company-issued prompts. In Tenet’s test, Claude Code on Sonnet 4.6 successfully followed the injected instruction nine out of ten times under Cloudflare’s recommended configuration.
Nothing malfunctioned in the usual chain of events: firewall blocking, valid credentials, and endpoint detection systems remaining silent. Tenet found evidence of this setup at 48 organizations, including six confirmed Fortune 500 companies. SecurityWeek also reported on the same attack vector against Datadog and Sentry.
OWASP’s co-lead, Steve Wilson (Chief AI and Product Officer at Exabeam and project co-lead for OWASP Top 10 for LLM Applications), suggests a solution:
"The first thing I’d do is put an authorization gate outside the model... The agent can propose the exact DNS change, but it cannot grant itself the authority to make it."
This approach relocates decision-making power, ensuring that only authorized and clearly defined changes are implemented.
Wilson emphasizes: "The tradeoff is that the agent loses the ability to improvise arbitrary, high-impact infrastructure changes on its own... while retaining autonomous investigation and routine, bounded remediation."
He also warns against security rules written within prompts: “They are still suggestions to the model, not enforceable security controls.”
GhostJacking requires no compromised admin account or bypassed firewall. It leverages agents that read operational data and hold write access to systems. SC Media reported that Tenet utilized Cursor, a coding agent integrating with GraphQL and Cloudflare API, for their demonstration.