Kiran 
Tenet Security stunned the DEF CON 34 audience on August 9 with a demonstration that inverts one of the most basic assumptions in enterprise defense: that a blocked attack is a defeated attack.
Presented on the conference’s Main Track by Tenet’s Barak Sternberg, Nevo Poran, and Ron Bobrov, the research dubbed “GhostJacking” shows that a request rejected by Cloudflare’s own web application firewall can still deliver a full domain takeover, simply because the AI agent reading the resulting log doesn’t know the difference between evidence and instruction.
The mechanics are almost insultingly simple. An attacker sends a request they know will be blocked, embedding a poisoned string disguised as scanner telemetry inside the User-Agent header.
Cloudflare’s WAF does its job and logs the blocked event verbatim. When a developer later asks their coding agent, such as Cursor or Claude Code, to review recent firewall activity, the agent ingests that log as trustworthy operational data and executes the embedded “fix,” rewriting DNS A records and adding attacker-controlled CNAME entries.
Traffic and email tied to the domain then reroute silently. Tenet clocked a 90% success rate against Claude Code running on Cloudflare’s own recommended security configuration.
The same architecture flaw was reproduced across Datadog and Sentry. Researchers found more than 2,700 publicly exposed Datadog client tokens embedded in website source code and CSP headers, allowing them to plant fake “urgent diagnostic” alerts that trick agents into running npx commands and harvesting environment secrets and cloud credentials.
On Sentry, nearly 2,400 leaked Data Source Names enabled a comparable injection and notably, Sentry’s own Seer AI accepted the attacker’s fabricated remediation and passed it along to a downstream coding agent, marking what researchers describe as the first documented agent-to-agent trust hop against a real, deployed system rather than a lab mockup.
Tenet also disclosed a zero-day in Anthropic’s Claude Desktop network sandbox, the mechanism meant to stop an agent from exfiltrating data.
The researchers found a bypass that let stolen data reach an arbitrary attacker-controlled server. Anthropic’s security team confirmed and patched the flaw before the talk; per Tenet’s disclosure guidance, the exact payload and token were withheld from the public presentation.
The unifying thread across all four techniques is that no rule was ever broken. EDR, WAF, and IAM controls stayed silent because every action reading a log, modifying DNS, running a diagnostic command was something the agent already had legitimate permission to do.
Tenet estimates the exposure extends to roughly 15,000 organizations, extrapolated from 73 source-linked artifacts across 48 organizations, including six confirmed Fortune 500 companies, a trillion-dollar tech firm, and a leading AI lab.
Tenet responsibly disclosed each finding to Sentry, Datadog, Cloudflare, and Anthropic well before the DEF CON talk, and is open-sourcing “agent-jackstop,” a hardening toolkit for Cursor and Claude Code.
Its core recommendations are to deny agents outbound network access by default, require human approval for any command execution, and treat anything an agent reads as data rather than an instruction it can act on.
As this research shows, the gap isn’t in any single vendor’s product; it’s in the assumption that authorized action is always safe action.
About the Author
