AI Vulnerabilities in Fortune 500 Firms: The Rise of Ghostjacking
Recent research conducted by Tenet Security has unveiled a concerning trend: half of Fortune 500 companies may be susceptible to cyberattacks made possible through their own AI systems. This vulnerability arises from a technique identified as "Ghostjacking," which allows malicious actors to exploit a company’s AI agents, circumventing traditional firewall defenses and creating opportunities for data breaches and other malicious activities.
Ghostjacking fundamentally changes the landscape of cybersecurity. It involves employing the very AI agents that organizations trust to bolster their security to instead reroute critical email and web traffic—effectively creating a covert passage that bypasses the company’s firewall altogether. Tenet Security’s researchers disclosed that a single fabricated bug report could enable an attacker to hijack coding assistants, allowing their code to be executed on a developer’s machine without raising alarms.
One of the glaring issues with this technique is that it exploits the access privileges already granted to AI agents. Consequently, while the firewall remains operational, it becomes irrelevant when faced with these manipulated requests. Attackers can take advantage of this flaw not only to infiltrate an organization but also to establish backdoors within the agent’s configuration, memory, and tools. This can provide them with persistent access to sensitive data, paving the way for data and credential theft.
Interestingly, the researchers detailed a particularly alarming method of exploitation where one AI agent could be induced to create an attack that would be recognized and accepted by another AI. This phenomenon has been described as a "self-exploit" technique, underscoring a complex interplay among AI systems that can be ruthlessly manipulated by hostile entities.
The implications of these findings are severe, as the Ghostjacking methodology demonstrates efficacy across widely used software platforms. Major tools employed by developers, including Cloudflare, Datadog, and Sentry, are at risk, raising alarms given their widespread adoption. Indeed, the results of this research were prominently presented at DEFCON 2026 in Las Vegas on August 9, during which Tenet Security’s team illustrated that the Ghostjacking technique was successful nine out of ten times against the Claude Code AI agent when set up in accordance with Cloudflare’s recommendations.
Among the companies running vulnerable Cloudflare setups are formidable players, including a trillion-dollar global technology firm, a leading global payments provider, and a prominent AI research lab. Tenet Security’s study noted that Cloudflare is utilized by 42% of Fortune 500 companies, managing a staggering fifth of all internet traffic. Datadog boasts an installation rate in 48% of these corporations, while Sentry is leveraged by approximately four million developers worldwide.
These findings accentuate the increasing risks borne from the reliance on AI agents for code and infrastructure management. It becomes evident that AI systems cannot reliably discern between genuine instructions and hidden traps embedded within data they process. Tenet Security characterized Ghostjacking as the evolution of the "Agentjacking" attack class, which similarly tricks AI coding agents into executing unwanted code on development machines.
The foundation of Ghostjacking lies in the mechanics of the Cloudflare firewall. When a malicious request is blocked, the firewall records the incident verbatim in its logs. An attacker can then inject a crafted log entry that misleads the AI into interpreting it as a legitimate security event when requested to review blocked incidents. This misinformation allows the AI to manipulate the company’s DNS settings, diverting domain traffic to the attacker while falsely reporting that the concern has been addressed.
In addition, the Datadog platform was found vulnerable to Ghostjacking as well, primarily due to API keys—meant exclusively for frontend use—being left publicly accessible. In their research, Tenet identified more than 2,700 of these exposed keys, which attackers could use to transmit a fabricated "urgent diagnostic alert," further compromising the security framework in place.
Sentry’s AI platform also fell victim to the Ghostjacking methodology. Researchers utilized its AI, known as Seer, to authenticate their presence to subsequent agents, leveraging the system’s inherent trust in its own processing to run malicious code. The researchers noted the consistent vulnerability across these platforms, highlighting a pattern in which AI systems are reading unverified external data and acting upon it, thereby opening doors to potential intrusions.
In light of these alarming vulnerabilities, Tenet Security has recommended several measures to mitigate exposure to Ghostjacking attacks. Organizations are urged to deny outbound network access by default—a step that can effectively thwart unauthorized downloads and potential data leaks. They are also advised to mandate human oversight for any commands that an AI agent seeks to execute, ensuring that no extraneous data can be automatically interpreted as legitimate instructions. Additionally, organizations should treat every reachable token as potentially compromised and scrutinize the connections established by their agents.
As the digital landscape evolves, the emergence of vulnerabilities, including those unveiled through Ghostjacking, serves as a critical reminder of the need for robust cybersecurity protocols—especially as enterprises become increasingly reliant on AI solutions. This not only calls for heightened awareness but also a re-evaluation of how AI agents interact with essential infrastructure and data, lest organizations fall victim to their own technologies.