"Ghostjacking": Poisoned Cloudflare, Datadog, and Sentry Records Turn AI Agents Into Insiders

AI coding and operations agents that read observability data, demonstrated against Claude Code, Claude Desktop, and Sentry's "Seer" agent, across Cloudflare, Datadog, and Sentry

Tenet Security presented Ghostjacking at DEF CON 34. The technique plants attacker instructions in the places an agent already trusts: a request Cloudflare's firewall blocks is still logged verbatim, so the payload rides into the log the agent later reads; exposed Datadog API keys let an attacker file a fake "urgent diagnostic" alert; a crafted Sentry error report steers Sentry's own AI agent into endorsing a malicious fix. The agent then acts with the access it was already granted, which is why the chain produces no alerts from EDR, WAF, IAM, VPN, or firewall. Demonstrated outcomes included DNS hijacking and domain takeover, code execution, theft of cloud credentials and environment secrets, and backdoors written into the agent's own configuration, memory, and tool definitions for persistence. Against Claude Code via the Cloudflare path the technique worked nine times out of ten. Tenet reported Cloudflare in use at 42% of the Fortune 500 and Datadog at 48%, Sentry trusted by roughly four million developers, and more than 2,700 improperly exposed Datadog keys found during the research

The same component both reads untrusted external data and holds the authority to act on it, so a log entry is indistinguishable from an instruction. Security tooling logs hostile input faithfully by design, which turns the observability pipeline into a delivery channel that points directly at the agent. Tenet's recommended mitigations are to deny outbound network access by default, require human approval before an agent executes a command, and never let data an agent reads become an instruction it runs