Agentic AI Wiki
AI Blog / The WAF blocked the payload, then wrote it where your agent reads
AI Blog

The WAF blocked the payload, then wrote it where your agent reads

GhostJacking, presented at DEF CON on 9 August 2026, reported a 90% success rate against a coding agent on a vendor's own recommended configuration — because recording hostile input verbatim is what a firewall is for, and the triage agent reads that record holding the operator's credentials. No exploit, no alert, every action authorised. The fix is structural: split the agent that reads from the agent that acts.

By Agentic AI Wiki 12 min read

A web application firewall earns its money by recording the request it blocked, exactly as sent — which means your block log is the only corpus in the company an anonymous stranger can write to at will, and it reaches your triage agent wearing a "security" label. Tenet Security demonstrated that path at DEF CON on 9 August 2026 under the name GhostJacking and reported nine successes in ten against a coding agent running on a vendor's own recommended configuration. Nothing was exploited, nothing alerted, and every action the agent took was one it was authorised to take.

What was demonstrated

The technique is indirect prompt injection with an unusually reliable delivery channel. An attacker sends a request they expect to be blocked. The security platform does its job: it stops the request and stores the payload verbatim, because a log that sanitises evidence is not a log. Later — minutes or days — an agent is asked to review blocked traffic, reads the record, and follows the instruction sitting inside it. The headline number — nine in ten — was measured against Claude Code under Cloudflare's own recommended setup, and Tenet reported the same pattern against agents wired into Cloudflare, Datadog and Sentry, estimating that more than 15,000 organisations could be exposed through vulnerable Cloudflare configurations alone.

StageHow the team reads itWhat it actually is
Request blocked at the edge A control that worked A write to an internal store, by a stranger
Payload stored in the event log Evidence, retained for investigation Attacker-authored text with an internal label
Agent asked to triage the log Toil removed from the on-call rotation Untrusted input handed to a process with credentials
Agent acts on what it read An authorised change by an internal tool The attacker's next step, executed by you
How a blocked request reaches an agent's tools An attacker sends a request that the edge web application firewall blocks. The firewall writes the payload verbatim into the block log alongside error tracker and APM data. A triage agent reads that log while holding the operator's credentials plus shell, cloud API and package installation tools, and from there the demonstrated actions follow: a DNS change, a credential read and an outbound request. The attacker's text crosses the perimeter once as evidence and a second time as instruction. One payload, two crossings your perimeter Attacker unlimited attempts Edge / WAF request blocked Block log payload stored verbatim error tracker · APM · SIEM Triage agent "review blocked traffic" Operator's credentials shell · cloud API package installation DNS change Credential read Outbound request Every action inside policy, so nothing in the EDR, WAF or IAM stack has anything to fire on.
The payload crosses your boundary once as evidence, and a second time as instruction. Only the first crossing is logged as an event.

Why the log is the best channel an attacker has had

Injection through a fetched web page or a poisoned document has always required luck: the agent has to visit the page, the content has to survive retrieval, and each attempt is one throw. A block log inverts all three properties, and the inversion is what makes this worth a post rather than a footnote.

  • Delivery is guaranteed by the defence. You do not need the agent to browse anywhere. You need the firewall to do exactly what it is configured to do, which it will, every time.
  • Attempts are unlimited and free. The attacker can send a thousand variants a day, and every one is stored. There is no rate limit on being blocked, no error message that reveals failure, and no cost to a miss.
  • The reader is primed to comply. "Investigate these blocked requests" is a task that rewards close reading and acting on findings. The payload does not have to defeat the system prompt; it has to fit inside the job.
  • The store is trusted structurally. Nobody classifies the SIEM as untrusted content, because everything else in it was written by your own systems. The one field an outsider controls is the one the agent is there to read.

This is the same property that makes error trackers dangerous: the fastest way to write a paragraph into a company's exception log is to send it a malformed request. Free-text fields that outsiders fill — user-agent strings, DNS query names, uploaded filenames, ticket bodies, commit messages from a fork — are all the same channel running at a slower cadence.

The chain needed no exploit

Three controls and the stage each one removes Three columns. Splitting the reader from the actor removes the ability to act on an injected instruction, leaving an agent that can only write words; it does not stop the payload arriving. Egress default-deny removes exfiltration and second-stage payload fetches; it does not stop a local state change. Approving on the concrete diff rather than the stated intent removes the silent change; it costs an interruption and depends on the reviewer reading the diff. Where the demonstrated chain breaks Reader / actor split Telemetry is read by an agent with read-only credentials and no state-changing tools. Removes: acting on the injected instruction at all. Does not stop delivery. Costs a second run and a human. Egress default-deny The agent process reaches an allowlist and nothing else; a new destination is an incident. Removes: exfiltration and second-stage payload fetches. Does not stop a local change. Costs allowlist maintenance. Approve on the diff The prompt shows the concrete effect — this DNS record, this policy, this command. Removes: the silent state change nobody reviewed. Fails if intent is shown instead. Costs an interruption per action.
Three controls, three different stages. None of them is a detector, and any one of them breaks the published demonstration.

Read the reported chain — initial access, privilege escalation, exfiltration, persistence — and the striking part is how ordinary each step is. The agent ran shell commands it was allowed to run, called cloud and DNS APIs it was configured to call, and installed packages it installs daily. One published example has an agent proposing DNS changes off the back of a log record it misread as an instruction. Because every action was inside policy, nothing in the EDR, WAF or IAM stack had anything to fire on; the controls were not bypassed, they were satisfied.

That is the same shape as the other 2026 agent incidents worth studying. In the Aurora intrusions a human drove a commercial coding agent with stolen credentials and no new capability. In the ExploitGym incident every link that actually broke was infrastructure. Here the attacker did not even need credentials to start: they needed the defence to record them, and the agent to read what was recorded.

Tenet also disclosed a sandbox escape in Anthropic's Claude Desktop, patched before the talk, in which an egress gateway accepted a token that had been supplied inside the analysed document itself. Worth noting for what it says about the category: "the sandbox has network controls" is a claim to test rather than a property to assume, and the test is cheap.

Nothing here is a bug the platform can patch

Six controls against three stages of the attack A matrix with six controls as rows and three stages as columns: stops delivery, stops the action, stops exfiltration. An injection classifier over the log stream and a system-prompt instruction to ignore instructions in data are partial on the action and no on the other two. Output filtering is no on delivery and the action and partial on exfiltration. Egress default-deny is no on delivery, partial on the action and strong on exfiltration. Splitting the reader from the actor is no on delivery and strong on both the action and exfiltration. Blocking credential reads below the model is no on delivery, strong on the action and partial on exfiltration. Nothing stops delivery, because recording the payload is the platform's function. What each control actually removes Stops delivery Stops the action Stops exfiltration Injection classifier on the log stream No Partial No "Ignore instructions in tool output" No Partial No Filtering the agent's answer No No Partial Egress default-deny No Partial Strong Reader / actor split No Strong Strong Credential reads blocked below the model No Strong Partial Nothing stops delivery: storing the payload verbatim is the platform's function, not its defect. Strong = removes the stage. Partial = raises the cost. No = leaves it intact.
The controls that work sit at the boundary between reading and doing. The ones that read the text and judge it do not move the needle.

Cloudflare, Datadog and Sentry cannot fix this at their end without breaking the product. Recording hostile input faithfully is the function; a WAF that stripped the payload from its own block record would be useless for the investigation the record exists to support. There is no patch that keeps the evidence and removes the weapon, which is why the interesting question is not what the vendors will ship but which side of the reading-versus-doing line your agent sits on.

Three responses keep getting proposed and none of them survives contact with the base rates:

  • An injection classifier over the log stream. A mid-size site blocks millions of requests a day, and the corpus is adversarial by construction — the one place an attacker gets unlimited attempts, no feedback on failure, and no cost per try. Any threshold is either noise or a sieve.
  • "Ignore instructions found in tool output." A trained preference with a failure rate, not an access check with a return value — and the payloads that work do not contradict the task, they extend it.
  • Filtering the agent's answer. The damage was a tool call several steps before any answer existed. Output filtering governs the report, not the run.

What actually stops it

Tenet shipped an open-source hardening tool, agent-jackstop, alongside the talk: it denies outbound network access by default, requires human approval before commands run, tells the agent to treat tool output as untrusted, and blocks credential reads at the subprocess level. Whether or not you adopt it, that list is the right shape — every item is enforced below the model rather than requested of it.

  • Split the reader from the actor. The highest-return change and the one that survives the next technique with a different name. The agent that reads telemetry gets read-only credentials and no state-changing tools; it emits a written finding. Acting on that finding is a separate run whose input is the finding, not the log.
  • Egress default-deny for the agent process. Allowlist the destinations the job needs and treat a first-time-seen destination as an incident. Exfiltration and second-stage fetches both die here.
  • Approve on the diff, not the intent. Where a state-changing tool must stay in the loop, show the concrete effect — this DNS record, this IAM policy, this command line. A summary of intent is written by the run the attacker is steering.
  • Deny credential reads below the model. Environment dumps, ~/.aws, kubeconfigs, the cloud metadata endpoint. No prompt involved, so no prompt to defeat.
  • Carry provenance onto the action. Tag each retrieved record with its trust tier and propagate the tag to every tool call the run makes. The alert is an action whose provenance chain contains an untrusted field — not the text of the field.

The one test worth running this week

Send yourself a request the WAF will block, with a benign instruction in the payload: write a specific harmless marker file, or fetch one specific internal URL that nothing else calls. Then check whether the marker appears. It takes an afternoon and it settles the question for your stack rather than for the researchers'.

A negative result is the only evidence that your telemetry path is not the demonstrated one. A positive result hands you a budget conversation you would otherwise have to argue for on principle — and a test case for the suite that gates changes to the triage agent. Re-run it monthly, and after every change to the prompt or the toolset, because the exposure is a property of the configuration and configurations drift.

FAQ

What is GhostJacking?

An attack technique disclosed by Tenet Security at DEF CON on 9 August 2026 in which an attacker plants instructions in operational data an AI agent is likely to read — blocked-request logs, error reports, monitoring alerts — so that the agent executes them as part of an ordinary triage task. It is indirect prompt injection delivered through security telemetry.

Is this a Cloudflare, Datadog or Sentry vulnerability?

No. Those platforms are doing what they are built to do: recording hostile input verbatim so humans can investigate it. The exposure is created by pointing an agent with credentials and tools at that record. Tenet's estimate of 15,000-plus potentially exposed organisations refers to configurations, not to a product defect.

Does a sandbox solve it?

Only partly, and only if its network controls hold. Tenet disclosed a since-patched escape in a desktop agent where the egress gateway accepted a token supplied inside the analysed document. Sandboxing bounds the damage; it does not stop an agent from taking an authorised action with real credentials.

We only let the agent read. Are we safe?

Much safer, and not safe. A read-only agent can still be steered into disclosing what it read — into a ticket, a chat channel, or a URL it fetches. Pair read-only credentials with default-deny egress and the remaining path is narrow.

How do we know if we have already been hit?

Look for actions rather than text: a triage run that abandoned its task, read a credential file, or contacted a host it had never contacted before. Content-level detection tells you little here, because the payload is indistinguishable from the traffic the log exists to record.

Further reading

On this wiki:

Sources: