New Attacks Ghostjack and GhostSplice Target AI Agents
Ghostjacking & GhostSplice Attacks Target AI Agents
Related Entities
Organizations
Products & Tech
Full Report
Executive Summary
Security researchers have demonstrated two novel attack techniques, Ghostjacking and GhostSplice, that expose significant vulnerabilities in the way enterprise AI agents and coding assistants process information and interact with external tools. Ghostjacking tricks AI agents by embedding malicious commands within trusted data sources like security logs, leading to indirect prompt injection. GhostSplice involves a malicious server splitting a harmful command into benign-looking fragments that the AI later reassembles and executes. These attacks, presented at DEF CON 34, illustrate a new class of threats where the data supply chain of AI agents is compromised, turning helpful automated systems into internal threats capable of data exfiltration and unauthorized actions.
Threat Overview
As organizations integrate AI agents into their workflows, granting them access to sensitive data and system tools, the security of the agents' operational context becomes paramount. These new attacks shift the focus from direct prompt injection to poisoning the environment and data sources the AI relies on.
Ghostjacking: Poisoning the Data Well
Developed by researchers at Tenet, Ghostjacking is a form of indirect prompt injection. The core concept is to embed malicious instructions within a data source that an AI agent is expected to ingest and analyze as part of its normal function.
- Attack Vector: The attacker poisons a log file, such as a Cloudflare WAF block event log, a Datadog application log, or a Sentry error report. This can be done by generating a request that gets logged or by exploiting a leaked API token to inject logs.
- Execution: An operator asks the AI agent a legitimate question, such as "Can you analyze the latest security alerts?" The agent reads the poisoned log file. The malicious instructions within the log are parsed and executed by the agent, which cannot distinguish them from the legitimate data it is supposed to be analyzing.
- Impact: In a demonstration, the agent was tricked into altering the company's DNS settings to an attacker-controlled domain. The attack reportedly had a 90% success rate against the Claude Code model.
GhostSplice: Reassembling a Malicious Command
Demonstrated by the ASSET Research Group, GhostSplice targets the Model Context Protocol (MCP), an open standard for AI assistants to interact with external tools.
- Attack Vector: A malicious MCP server interacts with the AI agent. Instead of sending a single, obviously malicious command that might be blocked by safety filters, it splits the command into multiple, seemingly innocuous fragments.
- Execution: The fragments are delivered to the agent's context window through different, trusted channels. For example, one part of the command might be in a tool's description, while another is in the result returned by that tool. The AI agent, in its process of synthesizing information, stitches these fragments together into the complete, malicious command.
- Impact: This technique was shown to successfully bypass the agent's safety controls to exfiltrate sensitive data like SSH keys and source code, even when a direct request to do so had been denied.
Technical Analysis
These attacks represent a sophisticated form of Prompt Injection (T1589.004), but with a crucial difference: the injection point is not the user's prompt but the agent's external data sources and tools.
- Ghostjacking exploits the Trust Boundary Violation between the AI agent's core logic and the external data it consumes. The agent implicitly trusts that data from a Cloudflare or Datadog log is just data, not a set of instructions.
- GhostSplice exploits the agent's context assembly process. The agent's function is to combine disparate pieces of information to form a coherent understanding. GhostSplice abuses this very function, making the agent an unwitting accomplice in constructing the attack payload.
Impact Assessment
The business impact of these attacks is severe. A successful Ghostjacking or GhostSplice attack can turn a trusted, highly-privileged AI assistant into an insider threat. Since these agents are often granted access to code repositories, cloud dashboards, and sensitive databases, an attacker can use them to:
- Exfiltrate source code, API keys, and customer data.
- Execute arbitrary code within the CI/CD pipeline.
- Modify cloud infrastructure (e.g., change DNS records, create rogue user accounts).
- Deploy malware or backdoors.
The stealthy nature of these attacks makes them difficult to detect. The malicious action appears to be initiated by the legitimate, authorized AI agent, making it challenging to distinguish from normal operations in audit logs.
Cyber Observables — Hunting Hints
Detecting these attacks requires monitoring the inputs and outputs of AI agents, not just the prompts.
AI Agent Activity Logs"Ignore previous instructions and..."Unusual data exfiltration by AI agentCloudflare/Datadog/Sentry APIDetection & Response
- Input Sanitization/Output-Scrubbing: Implement strict sanitization on all data before it is fed to an AI agent. Treat all external data as untrusted. Similarly, scrutinize the commands the agent generates before execution, especially those involving sensitive actions.
- Least Privilege for AI Agents (D3-UAP): Grant AI agents the minimum possible permissions to perform their tasks. An agent that only needs to read logs should not have write access to DNS records.
- Human-in-the-Loop: For high-risk actions, require human confirmation before the AI agent is allowed to execute a command. This provides a critical failsafe.
- Log Monitoring: Monitor the AI agent's activity logs for unusual patterns. Correlate the agent's actions with the data it has recently processed to identify potential indirect prompt injection attacks.
Mitigation
- Data Source Integrity: Secure the data sources that AI agents rely on. Rotate API keys for logging services like Datadog and Sentry, and ensure they are not publicly exposed in client-side code.
- Contextual Fencing: Develop AI agents with strong contextual boundaries. An agent should be able to differentiate between data-to-be-processed and instructions-to-be-executed, even when they originate from the same source.
- Tool Connection Security: For attacks like GhostSplice, ensure that all connections to external tools via protocols like MCP are authenticated and encrypted, and that the tool servers themselves are trusted and verified.
- Developer Training: Educate developers who are building and integrating AI agents about the risks of indirect prompt injection and other contextual attacks.
Timeline of Events
MITRE ATT&CK Mitigations
User Account Management
Apply the principle of least privilege to AI agents, restricting their access and capabilities to only what is necessary.
Mapped D3FEND Techniques:
Restrict Web-Based Content
Sanitize and validate all external data before it is processed by an AI agent to filter out malicious instructions.
User Training
Train developers and operators on the risks of indirect prompt injection and how to build more secure AI agent integrations.
D3FEND Defensive Countermeasures
Implement a strict principle of least privilege for all AI agents. An agent's service account should only have the bare minimum permissions required for its designated task. For example, an agent designed to analyze Sentry logs should have read-only access to those logs and no permissions to modify DNS, access code repositories, or provision users. Use separate, single-purpose agents for different tasks rather than one monolithic, highly-privileged agent. This approach contains the potential damage from a compromised agent, as a successful Ghostjacking attack could only perform actions within the agent's limited permission scope. Regularly audit these permissions to ensure they haven't expanded beyond their intended purpose.
Harden the configuration of the AI agent's execution environment. Implement a 'human-in-the-loop' confirmation step for any high-risk action the agent proposes. Before an agent can execute a command like 'git push' or 'terraform apply', the command and its parameters should be presented to a human operator for explicit approval. This acts as a critical circuit breaker. Furthermore, treat data ingested by the agent as untrusted input. Implement input sanitization and output encoding for all data passed to and commands generated by the LLM. This helps prevent the agent from misinterpreting data as executable instructions.
Establish comprehensive monitoring and auditing of AI agent activities. Treat the agent's service account like any other privileged user account. Log all actions performed by the agent, the data sources it accessed prior to the action, and the resulting outcome. Create SIEM alerts for anomalous behavior, such as an agent that typically only reads logs suddenly attempting to make outbound network connections or modify system configurations. Correlating the agent's actions with the data it has ingested is key to detecting a potential Ghostjacking attack. For example, an alert could trigger if the agent modifies a firewall rule immediately after processing a log entry that contained suspicious keywords.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.