Tenet Security's 'GhostJacking' Attack Tricked Claude Code Into Rewriting Cloudflare DNS Records 9 Times Out of 10

Overview

Security researchers at Tenet Security demonstrated an attack technique called GhostJacking that tricked the AI coding agent Claude Code into rewriting a company’s DNS records after reading a prompt-injection payload planted inside blocked-traffic logs, according to Tenet Security. In a Cloudflare-focused demonstration, the attack worked 9 times out of 10 against Claude Code running on Sonnet 4.6. The research, presented at DEF CON 34’s main track, was published by Tenet Security and covered by SecurityWeek and VentureBeat.

What We Know

The core mechanism, as described by Tenet Security, begins when a web application firewall blocks a malicious request that carries a prompt-injection payload hidden in the request’s User-Agent header. The firewall logs the blocked event, but the malicious text is stored unescaped. When an AI agent is later asked to review those blocked events, it reads the payload as an instruction rather than as flagged attacker content and acts on it. Tenet Security frames the underlying flaw this way: “The flaw: read + write in one session, verbatim log fields. Two conditions hold at once: a read-only data tool and a write/exec tool share a single session, and the log fields cross into the model with no trust annotations, crossing a boundary,” according to Tenet Security.

In the Cloudflare demonstration, that dynamic let the injected instructions cause the agent to alter DNS settings and add a CNAME entry capable of redirecting domains to attacker-controlled infrastructure, as reported by SecurityWeek. Testing against Claude Code on Sonnet 4.6 succeeded in 9 out of 10 attempts, a figure also cited by VentureBeat.

Tenet Security demonstrated variants of the attack against two other widely used platforms. Against Datadog, attackers exploiting exposed frontend API keys — over 2,700 of which were found publicly available — planted fake diagnostic alerts that prompted AI agents to execute arbitrary commands and exfiltrate credentials, according to SecurityWeek. Against Sentry, an attacker uses a crafted bug report that is read by Sentry’s AI agent, named Seer, “which adopts a proposed fake fix as its own,” and that fake fix is then passed along and trusted by coding agents downstream, per SecurityWeek.

Tenet Security also described a “self-exploit” technique for refining injection payloads: “Two isolated sessions with memory off: ‘Cursor A’ is the target, ‘Cursor B’ the helper. B is shown A’s failed attempt, analyzes exactly why the injection didn’t land, and rewrites the attack script (and the PIA inside it) to be more effective, a refusal-driven optimization loop,” according to Tenet Security. In effect, one instance of the Cursor coding agent was used to iteratively engineer a working prompt-injection payload against another.

On scale, Tenet Security’s research notes that Cloudflare is used by 42% of the Fortune 500 and carries roughly a fifth of all internet traffic, while Datadog is used by 48% of the Fortune 500, according to Tenet Security. Sentry, meanwhile, is trusted by close to 4 million developers, according to SecurityWeek. Tenet Security says it found public, source-linked evidence of exposed setups at 48 organizations, including six confirmed Fortune 500 companies, a figure also reported by VentureBeat: “Tenet Security found public evidence of the exposed setup at 48 organizations, six confirmed Fortune 500 companies.” Tenet Security extrapolates from that public evidence to an estimate of more than 15,000 organizations exposed overall, according to Tenet Security.

In response to the findings, security practitioners are converging on a specific fix: separating an agent’s ability to propose an action from its ability to approve one. Steve Wilson, Chief AI and Product Officer at Exabeam and an OWASP Top 10 for LLM Applications co-lead, told VentureBeat: “The first thing I’d do is put an authorization gate outside the model. The agent can propose the exact DNS change, but it cannot grant itself the authority to make it.” Under that model, agents can still investigate and recommend changes, but a named human must authorize high-impact actions such as DNS alterations, privilege changes, code deployment, or production traffic rerouting, per VentureBeat.

What We Don’t Know

Tenet Security’s 15,000-plus figure is explicitly an extrapolation from a smaller set of publicly confirmed cases, not a direct count of exposed organizations, according to Tenet Security. Neither Cloudflare, Datadog, nor Sentry has issued a public response cited in the available reporting, and it is not clear from the sources how many of the identified exposures, if any, have since been remediated. It is also not established whether the same 9-in-10 success rate would hold against other coding agents beyond the ones tested.

Industry Response

Asked whether any Fortune 500 company has publicly implemented a human-approval gate of the kind Wilson describes, Kayne McGladrey, a senior member of the IEEE, told VentureBeat: “I haven’t seen it done, and no, they haven’t come out and publicly said it.”