Topic starter
06/11/2026 6:39 pm
TL;DR: Ghostjacking can hijack AI coding agents through malicious instructions embedded in logs, with researchers showing a 90% success rate against Claude Code on Cloudflare's recommended configuration, according to Aizome research. The attack works because legitimate access and conventional identity controls do not evaluate whether a specific action matches the agent's current intent.
Editorial analysis by NHI Mgmt Group, based on content published by Aizome: “What Ghostjacking Taught Us About the Limits of Identity Governance”.
By the numbers:
- Researchers showed a 90% success rate against Claude Code on Cloudflare's recommended configuration.
Key questions
Q: What should teams do when an AI agent is suspected of prompt injection?
A: Contain the session, revoke the agent’s active credentials, and inspect the full chain of tool calls, retrieved content, and downstream writes before resuming service.
Q: Why does least privilege fail for AI agent workloads?
A: Least privilege fails when access cannot be enumerated at design time.
Q: How does an AI agent become vulnerable to log poisoning?
A: An AI agent becomes vulnerable when it reads operational logs as trusted input and uses them to decide actions, tools, or prompts.
Practitioner guidance
- Audit agent read sources Inventory every log, ticket, email, and monitoring feed that an AI coding agent can read, then classify which sources can carry attacker-controlled text into runtime decisions.
- Separate read and act scopes Do not let the same approval path cover both telemetry ingestion and operational change execution when the agent can be influenced by the data it reads.
- Add execution-time policy gates Require a policy check immediately before tool use when an agent proposes DNS changes, code execution, or downstream delegation based on untrusted content.
Bottom line: Ghostjacking shows that an AI agent can be authorised, well-scoped, and still unsafe when it follows malicious instructions hidden inside trusted content.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Identity governance for AI agents breaks when instruction provenance and action authority are treated as the same problem. The agent may be authenticated, authorised, and properly scoped, yet still be unsafe because it follows an attacker-controlled instruction embedded in trusted content. That means conventional identity review can confirm entitlement without proving safe execution. Practitioners should treat this as a governance split between who may act and what should be allowed to trigger action.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams reduce the risk of agentic AI systems acting on untrusted content?
A: Treat untrusted content as a control boundary, not just an input problem. Separate what the agent can read from what it can do, and limit any action path that can change configuration, launch tools, or expand permissions. The safest baseline is to inventory each agent identity, constrain connector scope, and require telemetry that shows the full action chain before deployment.
👉 Read our full editorial: Ghostjacking exposes the limits of identity governance for AI agents