GhostJacking is a novel attack class that leverages "Log Poisoning" to achieve indirect prompt injection against autonomous AI agents integrated into security orchestration, automation, and response (SOAR) pipelines. By intentionally triggering blocked security events—such as those flagged by a WAF or Firewall—attackers embed malicious instructions within the resulting telemetry logs. When an AI agent ingests these poisoned logs for analysis or incident response, it interprets the payload as a legitimate directive, bypassing perimeter defenses to execute unauthorized administrative actions or hijack agentic workflows. This mechanism effectively transforms security monitoring tools into delivery vectors for agent hijacking.

• Threat Model & Vulnerability Overview

  • Shifts exploitation from direct user-facing prompt interfaces to secondary-channel telemetry ingestion.
  • Exploits the implicit trust relationship between autonomous AI agents and "trusted" internal security logs.
  • Targets the "Agentic Kill Chain," where the initial trigger is a security violation that is successfully blocked but logged.

• Attack Mechanics & Exploitation Vector

  • Trigger Phase: Attacker sends a payload specifically designed to be intercepted by a WAF, ensuring a log entry is generated.
  • Poisoning Phase: The intercepted payload contains embedded instructions (Indirect Prompt Injection) within the log string.
  • Ingestion Phase: An AI agent tasked with automated triage or log review reads the poisoned telemetry.
  • Execution Phase: The agent processes the embedded instructions as a command, leading to unauthorized API calls, data exfiltration, or configuration changes.

• Systemic & Security Impact

  • Perimeter Bypass: Traditional defenses inadvertently facilitate the attack by documenting the malicious payload in logs.
  • Privilege Escalation: AI agents often operate with high-level administrative permissions to remediate threats, granting attackers direct access to system controls.
  • Workflow Compromise: High risk of silent manipulation of incident response workflows within Fortune 500 enterprise environments.

• Countermeasures & AI Alignment

  • Telemetry Sanitization: Treat all log data and security telemetry as untrusted user input before processing via an LLM.
  • Privilege Minimization: Implement strict Principle of Least Privilege (PoLP) for AI agent API keys and system permissions.
  • Human-in-the-Loop (HITL): Require manual authorization for high-impact agent actions triggered by automated log analysis.
  • Instructional Guardrails: Deploy system prompts that explicitly forbid agents from executing instructions found within analyzed data fields.

• Conclusion

  • GhostJacking reveals a critical architectural blind spot in the integration of LLMs within security operations.
  • As SOAR pipelines evolve, the attack surface expands from simple prompt windows to the entire enterprise telemetry stack.