A new attack technique exploiting AI agent MCP integrations turns error logs into hidden directives for the agents to make harmful changes or execute malware, Tenet researchers reported Sunday.The technique, called “GhostJacking,” was demonstrated to work against agents integrated with Cloudflare, DataDog and Sentry. The exploit was presented at the DEF CON 34 conference in Las Vegas by Tenet CEO and Co-founder Barak Sternberg, CTO and Co-founder Nevo Poran and Researcher Ron Bobrov on Sunday.To perform the GhostJacking exploit, an attacker first needs to plant error logs that an integrated AI agent will later read when a user prompts them to review and fix errors.For Cloudflare, this involves triggering a WAF block event that Cloudflare will then log; the User-Agent header of the blocked request is poisoned to contain an injection disguised as scanner telemetry that will lead the agent to make malicious changes in order to “resolve” a “finding.” In Tenet’s demonstration, a Cursor agent — with both GraphQL MCP read permissions and write permissions via the Cloudflare API MCP execute tool — ingests the poisoned User-Agent header and “patches” the DNS A record and adds a CNAME in response to the injected DNS “finding.” These changes allow website and email traffic to be rerouted to the attacker’s domain.The researchers found that this attack also has a 90% success rate when used against Claude Code running Sonnet 4.6, and discovered at least 48 organizations, including six confirmed Fortune 500 companies, using a potentially susceptible Cloudflare MCP setup.The Cloudflare attack only required the attackers to trigger a 403 error to plant their poisoned log; the DataDog and Sentry attacks involved exploiting exposed DataDog client tokens and Sentry Data Source Names (DSNs) to inject poisoned error logs.For the DataDog attack, the researchers discovered more than 2,700 client tokens leaked in website page sources and Content Security Policy/Reporting-Endpoints response headers. These tokens can be used to create poisoned log entries with fake errors and fixes, leading an agent reviewing the logs to run an npx command and execute a malicious package. Tenet demonstrated this attack on Claude Code running Sonnet 4.6.The Sentry attack uses a leaked DSN to send a fake error log to the Sentry ingest via HTTP POST; Tenet found nearly 2,400 exposed DSNs from sources such as website JavaScript and public GitHub repos. The fake error log contains an injection in markdown recommending a “resolution” to the error, leading the agent to run npx and execute the attacker’s malicious package.The researchers noted “agent-to-agent lateral movement” was possible between Sentry’s own Seer agent and another agent such as Cursor or OpenAI’s Codex. For example, when Cursor calls the Sentry MCP, Seer ingests the injected error and returns its analysis, which incorporates the attacker’s “resolution” as Seer’s own finding. Cursor trusts this finding, leading it to execute the malicious package, the researchers said.Tenet reported the GhostJacking exploits to Cloudflare, DataDog and Sentry, and also reported to Anthropic a Claude Desktop sandbox escape flaw it found that allowed for data exfiltration. This flaw allows an attacker to reuse a permissive JSON Web Token (JWT) from their own environment in the target environment through an indirect prompt injection from a poisoned document.When the victim uses Claude Desktop to analyze the malicious document, with the network sandbox on, the egress gateway accepts the reused token provided in the document, allowing for the sandbox escape and data exfiltration. Anthropic patched this flaw prior to the DEF CON presentation.
AI/ML
‘GhostJacking’ attack turns error logs into indirect prompt injections
An In-Depth Guide to AI
Get essential knowledge and practical strategies to use AI to better your security program.
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news
You can skip this ad in 5 seconds