Overview
Research published in August 2026 introduces ‘GhostJacking’, a novel attack technique that exposes critical identity governance gaps in AI agent architectures. The attack demonstrates how adversaries can leverage security alerts and blocked event notifications—ordinarily indicators of a defensive system functioning correctly—to manipulate the behaviour of AI agents and effectively hijack their actions. As organisations increasingly deploy autonomous agents to handle sensitive tasks, GhostJacking underscores the dangerous assumption that defensive signals can be trusted as ground truth by an AI system.
Technical Analysis
At its core, GhostJacking exploits the way AI agents process environmental feedback. When an agent encounters a blocked action or receives a security alert, it typically adjusts its behaviour in response. Attackers who can craft or inject malicious security alert content into the agent’s input stream can cause it to alter its decision-making, bypass intended workflows, or be redirected to attacker-controlled endpoints or actions.
The attack surface is particularly dangerous because:
- Alert signals are often implicitly trusted by agent orchestration layers, lacking the same scrutiny applied to external user inputs.
- Blocked event responses may trigger fallback logic in agents that attackers can predict and exploit to steer agent behaviour.
- Identity governance is frequently absent or immature in current agentic frameworks, meaning there is no robust mechanism to verify the legitimacy of instructions or environmental signals the agent receives.
This represents a form of indirect prompt injection where the malicious payload arrives through a defensive channel rather than a direct user message, making it harder to detect with conventional input filtering.
Framework Mapping
MITRE ATLAS:
- AML.T0051 – LLM Prompt Injection: The attack injects adversarial instructions via security alert channels to redirect agent behaviour.
- AML.T0012 – Valid Accounts: Hijacked agents may act under the legitimate identity and permissions of the agent, masking the intrusion.
- AML.T0047 – ML-Enabled Product or Service: The target is an operational AI agent deployed in an enterprise product context.
OWASP LLM Top 10:
- LLM01 – Prompt Injection: Malicious content in alert signals manipulates agent instructions.
- LLM08 – Excessive Agency: Agents operating with broad permissions amplify the blast radius of a successful hijack.
- LLM07 – Insecure Plugin Design: Integrations that surface security alerts to agents without sanitisation create exploitable pathways.
Impact Assessment
Organisations deploying AI agents in IT operations, security operations, or business process automation are directly at risk. A successfully hijacked agent could exfiltrate data, execute unauthorised transactions, escalate privileges, or serve as a persistent foothold within an enterprise environment. The risk is compounded when agents operate with elevated permissions or access to sensitive APIs. The research signals a systemic design gap rather than a narrowly scoped vulnerability, meaning many agentic platforms may be affected.
Mitigation & Recommendations
- Sanitise all environmental inputs: Treat security alerts, blocked event signals, and system notifications as untrusted data before they are processed by an AI agent.
- Enforce identity governance: Implement cryptographic or policy-based verification of instructions and environmental signals to ensure agents cannot be redirected by spoofed alerts.
- Apply least-privilege to agents: Restrict agent permissions to the minimum required for their designated task to limit hijack impact.
- Monitor and audit agent actions: Log all agent decisions and tool calls with anomaly detection to identify behavioural deviations consistent with hijacking.
- Red-team agentic systems: Proactively test agent pipelines with GhostJacking-style scenarios to uncover exploitable fallback logic.