AI agent misreads hacker message, proposes DNS changes without approval

Security researchers have demonstrated a new class of attack that turns AI coding agents into unwitting accomplices. By planting malicious instructions inside ordinary error logs, attackers can trick AI agents into proposing DNS changes that redirect web traffic to domains controlled by hackers. The technique, dubbed “Ghostjacking,” was unveiled at DEF CON 34 by Tenet Security researchers. It boasts a roughly 90% success rate against Claude Code setups. How the attack works AI agents operating within platforms like Cloudflare, Datadog, and Sentry routinely ingest data from external tools: error logs, alerts, diagnostic outputs. Ghostjacking exploits the fact that these agents treat all of that input as trustworthy by default. An attacker poisons the logs with carefully crafted instructions disguised as legitimate diagnostic commands. When an AI agent like Cursor running Claude Code reads that poisoned data, it interprets the malicious text as a real action item. The agent then proposes or attempts to execute DNS changes that would reroute a company’s web traffic to an attacker-controlled domain. Tenet’s researchers demonstrated the attack across multiple platforms. Cloudflare was t...