Coverage of last weekend's DEFCON presentation says half of the Fortune 500 are vulnerable to GhostJacking.

[u/compileindebug_175]

Coverage of last weekend's DEFCON presentation says half of the Fortune 500 are vulnerable to GhostJacking.

That’s the headline. Tenet Security's own research says six.

Tenet confirmed six Fortune 500 companies with the actual susceptible setup, not 250. Cloudflare runs in 42% of the Fortune 500 and Datadog in 48%, and those are the adoption stats that got turned into “half are vulnerable” in the retelling. Running the tool and having an AI agent with MCP write access reviewing its logs are not the same thing.

The attack is real, and the 90% success rate against Claude Code is not a rounding error. Tenet planted a fake WAF block event in Cloudflare’s logs and watched the agent hijack the DNS and report the issue as resolved. The same pattern worked on Datadog: one exposed client token, a fake diagnostic alert, and the agent executed attacker code and exfiltrated environment secrets. There’s nothing to patch because it’s not a bug. The agent reads data it trusts and acts on what it says.

The check is one question: does any agent you run have MCP write permissions to Cloudflare, Datadog, or Sentry, and are you asking it to review logs without a human approval step? That’s the actual exposure, and it’s narrower than the headline makes it sound.

[u/Iron_Stark778]

Is there any real way to prevent against this type of ghostjacking? If all an attacker needs to do is inject something like a fake network log then how do you stop an agent from reading that? You can't. The only thing I can think of is kind of what you said where you only give the AI read access, but then it can't take any actions which may defeat the whole purpose.

[u/compileindebug_175 → u/Iron_Stark778]

You're right that read-only defeats the purpose. The actual fix is a human approval step before any write action - the agent can still identify what needs doing, and a person approves the specific command before it runs. Tenet released an open-source tool called agent-jackstop that enforces exactly this: it lets the agent read and reason freely, but blocks execution until a human confirms. You keep the productivity; you break the chain at the point where the attacker's instruction would actually land.

The deeper issue Tenet names is that the same agent shouldn't both read external data and act on it in a single uninterrupted step. Separate those two- a read/analyze agent produces a summary, a human approves, action agent executes. That architecture stops GhostJacking even with full write permissions, because no instruction from a log ever reaches the execution step without a person in between.

The runtime behavioural approach they recommend is the longer-term answer: watch what the agent is about to do and stop it before it acts, rather than trying to sanitize every log entry at ingestion.