GhostJacking is a systemic exploitation technique targeting autonomous AI agents with WebAI integrations. By leveraging indirect prompt injection via malicious web content, attackers manipulate an agent's autonomous feedback loop to hijack its execution flow. This allows the attacker to abuse the agent's tool-calling capabilities (function calling) to execute arbitrary shell commands on host developer machines, exfiltrate sensitive API keys, and facilitate lateral movement. Effectively, this converts trusted productivity agents into LLM-orchestrated Remote Access Trojans (RATs), bypassing traditional input filters by poisoning the external data the agent consumes during autonomous browsing.

• Threat Model & Vulnerability Overview

  • Targets "WebAI" integrations where LLM agents possess autonomous browsing and execution capabilities.
  • Shifts the attack vector from direct user input (Prompt Injection) to indirect content consumption (Indirect Prompt Injection).
  • Exploits the inherent trust the agent places in external web data during autonomous operational loops.

• Attack Mechanics & Exploitation Vector

  • Attackers embed hidden instructions in web pages that the agent is programmed to visit or scrape.
  • Payloads intercept the agent's logic, overriding system prompts to redirect the agent's goals and priorities.
  • Manipulation of "Function Calling" logic forces the agent to invoke sensitive tools, such as local shell executors.
  • The autonomous feedback loop allows the agent to iteratively refine the attack based on system responses.

• Systemic & Security Impact

  • Full host compromise of developer workstations through the execution of unauthorized shell commands.
  • Unauthorized exfiltration of environment variables, private SSH keys, and cloud provider API credentials.
  • Establishment of persistent access by transforming the AI agent into a managed RAT.
  • Potential for lateral movement within corporate intranets using the agent's authenticated identity.

• Countermeasures & AI Alignment

  • Implementation of strict "Human-in-the-Loop" (HITL) requirements for all high-privilege tool calls.
  • Deployment of robust input sanitization and strict sandboxing for content consumed by autonomous agents.
  • Enforcing least-privilege access controls for agent execution environments to limit the blast radius.
  • Development of adversarial monitoring to detect anomalous tool-calling patterns or unexpected data exfiltration.

• Conclusion

  • GhostJacking demonstrates the critical risk of granting autonomous execution power to LLMs without rigorous boundary controls.
  • As AI agents evolve from "chatbots" to "action-bots," the primary attack surface shifts toward the external data they ingest.