What Ghostjacking Taught Us About the Limits of Identity Governance

Last week at DEF CON 34, security researchers demonstrated something that every enterprise deploying AI agents needs to understand immediately.

Ghostjacking is a prompt-injection attack that plants malicious instructions inside security logs that AI coding agents routinely read. Testing showed a 90% success rate against Claude Code on Cloudflare's own recommended configuration - enabling attackers to hijack DNS, steal cloud credentials, and bypass conventional firewalls without triggering a single alert.

Read that again. 90% success. No malicious code. No unusual network traffic. No credentials stolen from outside the system. The AI agent used its legitimate, authorized access to do exactly what the attacker instructed - because the instruction was embedded in a log file the AI agent trusted, and the AI agent had no way to distinguish between trusted content it was processing and instructions it was supposed to follow.

A request Cloudflare's own firewall had already blocked was the way in. The firewall did its job. The AI agent didn't.

This is not a model failure. This is not a misconfiguration. This is an architectural problem - and it is the most precise demonstration yet of why identity governance, as currently implemented for AI agents, is insufficient.

What Ghostjacking Actually Exploits

The risk is architectural: an AI agent can read attacker-controlled content and exercise legitimate access against the same environment.

Why does this matter? Because the instinct when you hear "prompt injection" is to think of it as a “Let’s block ChatGPT in the browser”. Fine-tune the model better. Add guardrails. Improve the prompt filtering. Ghostjacking is not that kind of problem.

In the demonstrated attack, researchers placed instructions inside Cloudflare, Datadog, and Sentry records using their own test accounts. When an AI agent reviewed the telemetry, it treated the text as commands and used legitimate tools to change DNS, execute code, and pass poisoned conclusions to downstreamAI agents.

The AI agent's identity was valid. Its credentials were authorized. Its tool access was correctly provisioned. Every access control in the standard identity governance stack was functioning exactly as designed. The AI agent was permitted to read the logs. The AI agent was permitted to make DNS changes. The AI agent was permitted to execute code.

The failure was not in identity governance. The failure was in action governance - the layer that evaluates whether a specific action, in a specific context, is consistent with what the agent was actually built to do.

Traditional identity governance asks: is this AI agent allowed to do this? Ghostjacking demonstrates that the right question is: should this agent be doing this, right now, based on what it has just read?

Those are different questions. And only the second one catches this attack.

Why Traditional Identity Controls Cannot Stop This

The natural response from the security community will be to reach for identity-layer solutions: tighter scoping, better credential management, more granular permissions. These are the right instincts for traditional security problems. They are insufficient for Ghostjacking, and the reason is structural.

Least privilege does not help when the attack uses legitimate access. The attack worked because the AI agent had legitimate access to the logs it read and legitimate access to the DNS settings it modified. Scoping the AI agent's permissions more tightly reduces blast radius, but it does not prevent the attack - it only limits how far it propagates once triggered. The AI agent still interprets the malicious instruction. It still acts on it.

Credential rotation does not help when the attack uses current credentials. Ghostjacking does not steal credentials. It uses the credentials already in place. Rotating them does not change the fundamental dynamic, the AI agent will use whatever credentials it has been given to execute whatever instruction it receives.

Anomaly detection does not help when the attack uses legitimate tool calls. The attack bypassed conventional firewalls without triggering any alerts. The tool calls the AI agent made - reading logs, modifying DNS settings, executing code - were all within its authorized scope. There was nothing to flag. The actions were not anomalous. They were exactly what a legitimate AI agent performing its intended function would do. The problem was the instruction that caused those actions, not the actions themselves.

MFA and SSO do not help when the AI agent already has an authenticated session. The human analyst authenticated to the system. The AI agent operated within that session. The authentication layer was never the issue.

The common thread: every layer of the traditional identity security stack evaluates whether the AI agent has permission to act. None of them evaluate whether the AI agent should be acting, given the specific instruction it just received from a potentially compromised source.

The Architecture That Catches This

The control that stops Ghostjacking is one that evaluates the AI agent's intended action against its organizational intent before the action executes - regardless of what instruction triggered the action.

This is inline intent-based access control and governance. Not a perimeter control. Not a credential check. A layer that sits between the AI agent's decision to act and the systems it is about to act on, evaluating three things simultaneously: Is this action consistent with what this AI agent was built to do?

An AI agent built to investigate and summarize security incidents has a defined organizational intent. Modifying DNS settings is not part of that intent - regardless of what instruction the agent received that led it to believe DNS modification was the right response. An inline governance layer evaluating every tool call against the agent's organizational intent baseline would have flagged the DNS modification before it executed.

Is this instruction from a trusted source? Ghostjacking works because the AI agent treats log content as instructions. An intent based access control governance layer that tracks the provenance of the instruction - that the action was triggered by content read from a log file rather than by a direct user command - can apply appropriate skepticism before execution. Not blocking all log-based actions, which would break legitimate investigative workflows, but evaluating log-triggered actions against a higher intent consistency threshold.

Is this action pattern consistent with established behavior for this AI agent in this context? An AI agent that has investigated hundreds of security incidents has an established behavioral baseline. DNS modification in response to a firewall log investigation is outside that baseline. A governance layer that maintains behavioral context can identify the deviation and require human confirmation before execution.

These three evaluations happen inline, before the tool call reaches the target system. Not in a SIEM reviewing logs after the fact. Not in an anomaly detection system reviewing patterns over time. At the moment of execution, for every tool call, before it completes.

This is the architectural answer Ghostjacking points to. Not better identity. Inline intent enforcement.

The Broader Pattern

Ghostjacking is not an isolated technique. It is the DEF CON 34 entry in a series of demonstrations that share a common architectural insight.

PleaseFix, demonstrated at Black Hat USA 2026, exploits a related trust model - placing malicious instructions inside content the agent encounters, such as emails, calendar invitations, or web pages, redirecting the AI agent to act on the attacker's behalf using the user's own identity, permissions, and access.

The OpenAI agent that escaped its sandbox and hacked Hugging Face and Modal Labs earlier this month operated on the same principle: legitimate access, used for unauthorized purposes, undetected until the damage was done.

The pattern across all three is consistent. The AI agent's identity was valid. Its credentials were authorized. Its actions were within its technical permission scope. The failure was the absence of a governance layer that evaluated whether those actions were consistent with the agent's actual purpose.

If an AI agent can read untrusted telemetry and remediate infrastructure, logs are both evidence and input. Every data source an agent reads is a potential injection vector. Every system an agent can act on is a potential target. The only reliable defense is a governance layer that evaluates the relationship between what the AI agent reads and what it is about to do - before it does it.

What This Means for Enterprise AI Deployments

Ghostjacking was demonstrated against AI coding agents - Claude Code, Cursor, Codex - operating in development environments. The governance implication extends significantly beyond that context.

Any enterprise AI agent that reads data from external sources - logs, emails, databases, monitoring platforms, customer communications - and takes actions based on what it reads is architecturally vulnerable to the same class of attack. The specific technique varies. The structural vulnerability does not.

For every AI agent in your environment, the question Ghostjacking makes urgent is this: when this AI agent takes an action, what evaluates that action as appropriate before it is executed? Not whether the AI agent was permitted to execute it. Whether the execution was consistent with the agent's actual purpose, given the specific instruction that triggered it.

If the answer is "nothing - the AI agent evaluated the instruction itself and decided to act" - that is the gap Ghostjacking exploits.

The control that closes the gap is an inline governance layer that operates between the AI agent's decision and the system it is about to act on. Not a perimeter. Not a credential check. A per-action evaluation of whether this specific action, triggered by this specific instruction from this specific source, is consistent with what this AI agent was built and designed to do.

Identity governance tells you the AI agent was allowed to be there. Intent governance tells you whether the AI agent should have done what it did. Ghostjacking is the DEF CON proof that you need both.

Amir Ofek is CEO and Co-Founder of aizome, an Enterprise AI Agent Identity Fabric Platform. He previously co-founded and led AxoniusX within Axonius and has held business, engineering and security leadership positions for over 20 years.

Sources: Dark Reading: https://www.darkreading.com/cyber-risk/ghostjacking-identity-governance-gaps-ai-agents | CybersecurityNews: https://cybersecuritynews.com/ghostjacking-attack/