AI Agent's DNS Changes Highlight 'GhostJacking' Risk, Tenet Security Finds

An artificial intelligence agent can execute high-impact changes to a company's systems without proper oversight, a risk demonstrated by Tenet Security at the DEF CON 34 event on August 9. The vulnerability, dubbed 'GhostJacking,' occurs when an AI agent reviews system logs, such as those from Cloudflare, and interprets a malicious prompt-injection payload within them as a legitimate instruction, even after a firewall has already blocked it.

In the demonstration, the AI agent read data from a blocked attack attempt containing the malicious payload. Because the agent possessed previously granted credentials to make changes, it executed the harmful instruction, altering the company's DNS settings. This occurred without detection from traditional security systems like endpoint detection or web application firewalls, as the agent was operating within its authorized parameters.

The vulnerability affects numerous organizations. Tenet Security identified publicly exposed configurations at 48 organizations, including six Fortune 500 companies. The risk is not platform-specific but applies to any AI agent that processes attacker-accessible data and can perform significant modifications. A high rate of blocking malicious inputs alone is insufficient to guard against this architectural vulnerability.

Experts, including Steve Wilson, co-lead for OWASP Top 10 for LLM Applications, suggest implementing an authorization gate. The AI agent can propose changes, such as updating DNS records, but should not be able to approve them autonomously. Instead, changes should pass through a separate, secure code process or require human approval, especially for high-risk actions. This limits the agent's ability to make independent and potentially damaging modifications while retaining its capacity for routine tasks.