Tenet Security researchers demonstrated at DEF CON 2026 that injecting malicious instructions into logs and alerts from Cloudflare, Datadog, and Sentry causes AI agents to execute them with a 90% success rate. This isn’t a bug you can patch. It’s a design assumption breaking at scale.
We’ve given AI systems read access to infrastructure monitoring and authorization to act on commands. The security tools we built to defend systems become the attack vector. Standard defenses see nothing wrong: the agent is doing exactly what it was authorized to do.
The scope is staggering: 15,000+ organizations potentially exposed, with zero detections from EDR, WAF, or IAM. The attack progresses through four phases: poisoned logs, escalation, data exfiltration, and persistence. The precision reads like a playbook for what not to do.
The real problem sits at the intersection of trust models and permission boundaries. Agentic architectures have inherited permission systems built for humans and services, not for systems that read broadly and act immediately. Tenet’s research documents exactly why this breaks, and until we rethink how agents constrain access, this class of attack scales with adoption.
Sources: Ghostjacking Attacks: The Agentic Kill Chain
Coverage: SecurityWeek • Dark Reading
Related on this blog: [AUTO] Guardrails Are Usability Theater • AI Browsers Keep Getting Hijacked, and Nobody Claims a Fix • The Payload Was Never in the Package