Ghostjacking

What Ghostjacking Means in Practice

Ghostjacking is not a simple account takeover, because the attacker’s goal is to inherit an AI assistant’s operating context rather than just its login. That makes it a subtle form of control theft: the visible identity may remain unchanged while the assistant starts acting on behalf of the wrong operator, with the wrong intent and data access.

The defining feature is persistence across runs. If session state, delegated authorization, or hidden instructions survive between interactions, the attacker can keep steering the agent without re-entering the account or visibly reconfiguring it. That is why ghostjacking is especially concerning in assistants that can invoke tools, retrieve data, or perform tasks over time.

How Ghostjacking Happens

The attack usually depends on one of three mechanisms, stolen session state, abused delegated tokens, or persistent prompt manipulation. Each one gives the attacker a way to shape what the agent believes it is allowed to do, and each one can operate without the victim noticing an immediate credential change.

Stolen session state can preserve an authenticated context that the agent trusts. Delegated tokens can give long-lived or reusable access to tools and services. Hidden instructions can be more insidious still, because they may alter the assistant’s behaviour repeatedly even after the original injection point is gone.

Why Ghostjacking Is Dangerous

Ghostjacking is dangerous because an AI agent often has more reach than a human user session. It may read mail, query internal systems, update records, trigger workflows, or call downstream services, so hijacking the agent’s intent can create real business impact without the obvious signals associated with a fresh login from a new device or location.

The trust failure is amplified when the assistant is allowed to act autonomously. A compromised agent can continue to process prompts, chain tool calls, and move data in ways that look operationally normal unless defenders understand what “normal” should look like for that specific agent and task boundary.

Detection and Recovery After Suspicious Behaviour

Detection should focus on the agent’s behaviour, not only the user account behind it. Unexpected tool calls, unusual data retrieval patterns, repeated actions that do not match prior instructions, and use of sessions that outlive their expected context are all signals that the agent may have been repurposed.

After suspected ghostjacking, the question is not only whether access was gained, but whether the agent’s state was contaminated. That means reviewing sessions, delegated grants, stored prompts, and any downstream actions the assistant took while under attacker influence, then confirming that the malicious influence was actually removed.

How Organisations Reduce Ghostjacking Exposure

Defence is strongest when the agent’s authority is narrow, short-lived, and observable. The safest operating model treats sessions, delegated permissions, and persistent context as things that must be explicitly bounded rather than assumed to be harmless because the underlying account still looks legitimate.

Architectures that separate user intent from tool execution are easier to defend than assistants that carry broad standing access. Clear ownership, prompt and state hygiene, and routine review of what the agent can keep between runs all reduce the chance that a hidden instruction or stolen context can survive long enough to matter.

Risk and Threat Considerations

Ghostjacking creates a high-value compromise path because it lets an attacker exploit trusted automation while blending into ordinary agent activity. The main risk is not just unauthorised access, but durable misdirection of an assistant that may already be authorised to read, write, or act across multiple systems.

Failure mechanism: The attacker preserves or reuses session context, tokens, or hidden instructions so the agent continues operating under attacker influence after the initial compromise point is gone.

Impact: The agent may exfiltrate data, perform unauthorised actions, or propagate false instructions into connected tools and workflows, creating a wider compromise than a single user session would normally allow.

Practitioner Guidance

Why practitioners should care: Ghostjacking is a governance problem as much as a technical one, because teams must decide who owns the agent’s authority, how long that authority lasts, and what state is allowed to persist between runs. If those decisions are vague, the assistant becomes easy to repurpose without obvious signs of takeover.

What to watch for: Treat any mismatch between the agent’s recent actions and its expected task scope as a review trigger, especially when the behaviour persists across conversations or sessions. The safest assumption is that persistent context can be as sensitive as credentials when it controls what the agent is able to do.