Editorial illustration for AI agents can propose DNS changes but can't approve them, Tenet finds
AI Agents Bypass DNS Security in Tenet Study
AI agents can propose DNS changes but can't approve them, Tenet finds
An AI security agent at an unnamed company read a Cloudflare log entry, found an attacker's payload sitting inside it, and used it to rewrite the company's DNS records. Cloudflare's firewall had already blocked that exact payload. The blocking is what put it in the log in the first place.
Tenet Security calls this chain GhostJacking, and the firm walked the DEF CON 34 main stage through it on August 9. The mechanics are simple: a malicious request hits Cloudflare's managed ruleset, gets rejected, and gets stored byte for byte, poisoned User-Agent header included. An AI coding agent tasked with reviewing those blocked events has no way to separate the attacker's text from a legitimate instruction, and it acts on what it reads, using credentials the company handed it months before.
Tenet ran the scenario against Claude Code on Sonnet 4.6 under Cloudflare's own recommended setup. The agent followed the planted command nine times out of ten. Nothing broke to let that happen.
That's the part worth sitting with before the numbers.
“The first thing I’d do is put an authorization gate outside the model,” said Steve Wilson, Chief AI and Product Officer at Exabeam and project co-lead for the OWASP Top 10 for LLM Applications, in written responses to VentureBeat. “The agent can propose the exact DNS change, but it cannot grant itself the authority to make it.”
Why this matters Tenet's demo at DEF CON 34 is a clean illustration of a problem we keep flagging: giving an AI agent read access to security logs is not the same as giving it safe access. The Cloudflare ruleset did its job, blocking the malicious request. But storing that payload byte for byte, then letting Cursor treat it as trustworthy input, turned a defensive log into an attack vector.
Claude Code failed the same test nine times out of ten in separate runs, so this isn't a Cursor quirk. For teams wiring coding agents into DNS, firewalls, or any infrastructure tooling, the lesson is narrow but firm: agents can draft changes, but a human or a separate, non-agentic system has to approve anything that touches production records. That's a real constraint on the "autonomous ops" pitch a lot of AI infra startups are selling right now.
Founders building agentic security or DevOps tools should treat log ingestion as untrusted input by default, not as a convenience feature to bolt on later.
Related Reading
Business & Startups Nordic pilot adds Gemini for Education, NotebookLM to boost AI literacy
Business & Startups Kling launches Video O1, all-in-one model with MVL bridge using transformer
Business & Startups DeepSeek Seeks More Capital Weeks After USD 7B Funding Round
From Archives Meta Scrapped AI Layoffs Hours Before They Were Set to Begin
From Archives Arga Trains Enterprise AI in Full Work Environments
Common Questions Answered
What is GhostJacking and how does it exploit AI security agents?
GhostJacking is a vulnerability chain discovered by Tenet Security where an AI agent reads blocked malicious payloads from Cloudflare security logs and uses them to rewrite DNS records. The attack works because while Cloudflare's firewall successfully blocks the malicious request, it stores the payload in logs, which the AI agent then treats as trustworthy input and executes. This turns a defensive security log into an attack vector that bypasses the firewall's protection.
Why does giving AI agents read access to security logs create security risks?
Giving AI agents read access to security logs is fundamentally different from giving them safe access because logs contain blocked malicious payloads and attack data that should never be executed. When an AI agent treats logged security threats as trustworthy input, it can inadvertently execute the very attacks that were originally blocked by security systems. This creates a dangerous situation where defensive measures become attack vectors through the agent's misinterpretation of logged data.
What authorization control does Steve Wilson recommend for AI agents making DNS changes?
Steve Wilson, Chief AI and Product Officer at Exabeam, recommends implementing an authorization gate outside the AI model so that agents can propose DNS changes but cannot grant themselves the authority to execute those changes. This separation ensures that while AI agents can identify and suggest necessary DNS modifications, a separate approval mechanism must validate and authorize the actual implementation. This approach prevents AI agents from unilaterally modifying critical infrastructure like DNS records.
How did Claude Code perform when tested against the GhostJacking vulnerability?
Claude Code failed the GhostJacking test nine times out of ten in separate runs, demonstrating that this vulnerability is not specific to Cursor but represents a broader issue affecting multiple AI models. This consistent failure rate indicates that the fundamental problem of AI agents treating blocked malicious payloads from logs as trustworthy input is a widespread vulnerability across different AI systems. The vulnerability transcends individual AI tools and reflects a systemic security gap in how AI agents process security log data.
What was demonstrated at DEF CON 34 regarding AI agent security vulnerabilities?
Tenet Security demonstrated the GhostJacking attack chain at DEF CON 34 on August 9, showing how an AI security agent could read a Cloudflare log entry containing a blocked attacker's payload and use it to rewrite the company's DNS records. The demonstration illustrated that even though Cloudflare's firewall successfully blocked the malicious request, the act of logging that blocked payload created a new attack surface when AI agents were given access to those logs. This presentation highlighted a critical gap between defensive security measures and the risks introduced by granting AI agents read access to security infrastructure.
Further Reading
- The fix for the AI agent that hijacked a company's DNS: it can propose the change, but it can't approve it - VentureBeat
- GhostJacking: Tenet Turned Blocked Requests Into Agent ... - DeepInspect
- 'GhostJacking' attack turns error logs into indirect prompt injections - SC Media
- GhostJacking: AI Agents Turn Logs Into Attacks - Mirage Security
- Poisoned Logs Turn Enterprise AI Agents Into Attack Tools - AI Governance News
