GhostJacking poisoned logs can hijack AI agents: why it is not safe to use

What happened

At DEF CON 34 on August 9, 2026, Tenet Security disclosed "GhostJacking," an attack that targets AI agents through observability data. Observability data means logs, alerts, and error records that teams use to see what happened in a system. SecurityWeek reported that if an attacker can get text into those logs or alerts, an AI agent may read that text as instructions instead of as evidence.

ThreatInsights said the demonstrated attack chain let an agent change DNS settings to attacker-controlled infrastructure and then mark the incident as resolved. DNS is the system that directs internet traffic to the right place. It also reported a 90% success rate against one coding agent under a default Cloudflare setup.

What it means for you

If you use an AI agent to help investigate problems, the risk is not only in chat messages or files. Ordinary troubleshooting prompts such as "review these blocked events" may expose the agent to hostile text hidden inside trusted logs. A normal user may not realize the data itself is trying to steer the agent.

What to do instead

Treat logs and alerts as untrusted input, even when they come from familiar tools. Ask agents to summarize or explain first, not to make changes automatically. Keep approval turned on for actions like DNS changes, account changes, or closing incidents. Separate read-only review from tools that can edit production systems. AgentPod lists only reviewed, tested skills, but you should still prefer skills with clear limits and human approval for sensitive actions.

Sources:

• https://www.securityweek.com/ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad/
• https://threatinsights.net/ghostjacking-when-your-ai-agent-is-told-what-to-do-by-someone-else/