‘GhostJacking’ attack turns error logs into indirect prompt injections

A new attack technique exploiting AI agent MCP integrations turns error logs into hidden directives for the agents to make harmful changes or execute malware, Tenet researchers reported Sunday.

The technique, called “GhostJacking,” was demonstrated to work against agents integrated with Cloudflare, DataDog and Sentry. The exploit was presented at the DEF CON 34 conference in Las Vegas by Tenet CEO and Co-founder Barak Sternberg, CTO and Co-founder Nevo Poran and Researcher Ron Bobrov on Sunday.

To perform the GhostJacking exploit, an attacker first needs to plant error logs that an integrated AI agent will later read when a user prompts them to review and fix errors.

For Cloudflare, this involves triggering a WAF block event that Cloudflare will then log; the User-Agent header of the blocked request is poisoned to contain an injection disguised as scanner telemetry that will lead the agent to make malicious changes in order to “resolve” a “finding.”

In Tenet’s demonstration, a Cursor agent — with both GraphQL MCP read permissions and write permissions via the Cloudflare API MCP execute tool — ingests the poisoned User-Agent header and “patches” the DNS A record and adds a CNAME in response to the injected DNS “finding.” These changes allow website and email traffic to be rerouted to the attacker’s domain.

The researchers found that this attack also has a 90% success rate when used against Claude Code running Sonnet 4.6, and discovered at least 48 organizations, including six confirmed Fortune 500 companies, using a potentially susceptible Cloudflare MCP setup.

The Cloudflare attack only required the attackers to trigger a 403 error to plant their poisoned log; the DataDog and Sentry attacks involved exploiting exposed DataDog client tokens and Sentry Data Source Names (DSNs) to inject poisoned error logs.

For the DataDog attack, the researchers discovered more than 2,700 client tokens leaked in website page sources and Content Security Policy/Reporting-Endpoints response headers. These tokens can be used to create poisoned log entries with fake errors and fixes, leading an agent reviewing the logs to run an npx command and execute a malicious package. Tenet demonstrated this attack on Claude Code running Sonnet 4.6.

The Sentry attack uses a leaked DSN to send a fake error log to the Sentry ingest via HTTP POST; Tenet found nearly 2,400 exposed DSNs from sources such as website JavaScript and public GitHub repos. The fake error log contains an injection in markdown recommending a “resolution” to the error, leading the agent to run npx and execute the attacker’s malicious package.

The researchers noted “agent-to-agent lateral movement” was possible between Sentry’s own Seer agent and another agent such as Cursor or OpenAI’s Codex. For example, when Cursor calls the Sentry MCP, Seer ingests the injected error and returns its analysis, which incorporates the attacker’s “resolution” as Seer’s own finding. Cursor trusts this finding, leading it to execute the malicious package, the researchers said.

Tenet reported the GhostJacking exploits to Cloudflare, DataDog and Sentry, and also reported to Anthropic a Claude Desktop sandbox escape flaw it found that allowed for data exfiltration. This flaw allows an attacker to reuse a permissive JSON Web Token (JWT) from their own environment in the target environment through an indirect prompt injection from a poisoned document.

When the victim uses Claude Desktop to analyze the malicious document, with the network sandbox on, the egress gateway accepts the reused token provided in the document, allowing for the sandbox escape and data exfiltration. Anthropic patched this flaw prior to the DEF CON presentation.

GhostJacking: No single bug to patch, but rather a design reality

For the three MCP issues, the researchers said in a statement that “Everything was reported, and where fixable, fixed before this talk.”

However, they noted, “The pattern across the three is not a single bug to patch. It is a design reality the platforms acknowledge cannot be closed at their end.”

To help organizations reduce their exposure to attacks such as GhostJacking, Tenet released an open-source tool called agent-jackstop for Cursor and Claude Code, which denies outbound network access by default, requires human approval for any command, instructs the agent to treat tool output as untrusted and blocks credential reads at the subprocess level.

The researchers also recommend organizations audit all of their MCP connections to understand what tools their agents can access and how the data these tools return could be influenced by an attacker (such as errors, logs and tickets). They recommend treating all data that agents ingest as untrusted and never allowing a tool’s output drive command execution. They also highlight that agent’s actions are treated as authorized actions by endpoint defenses, necessitating the need for runtime detection of malicious behaviors.

“The real fix is behavioral runtime control at the agent, watching what it is about to do and stopping before it acts, with a kill switch,” the researchers stated. “Sandboxes and prompt hardening are not enough.”