ghostjacking hijacked an ai coding agent with just log files

the summer camp recap that actually matters

three weeks ago we told you what to watch at hacker summer camp. black hat and def con 2026 just wrapped, and one attack basically sums up the whole week. it's called ghostjacking, and it hijacked an ai coding agent 90% of the time using nothing but log files. no malware. no phishing email. no shady link. the tools you use to keep your systems healthy became the way in. that's the kind of finding that should make every team running ai agents stop and rethink their setup.

what ghostjacking actually is

ai coding agents don't just take instructions from you. a lot of them are wired up to observability systems, the logs, traces, and telemetry that tell the agent what's happening across your infrastructure so it can debug, fix, and act on its own. researchers showed that if you can influence what shows up in those logs, you can influence what the agent believes is true, and by extension what it does next.

think about it this way. the agent trusts its logs the same way you'd trust a coworker giving you a status update. if someone can quietly slip fake entries into that update, "hey everything's fine, go ahead and run this," the agent just... runs it. no exploit needed, no credential theft needed. just a well placed lie in a place the agent already trusts.

why this worked 90% of the time

the scary part isn't the cleverness of the attack, it's how little friction there was. most agent architectures treat observability data as low risk input. it's not user input, it's not a network request, it's "just logs." so it doesn't get sanitized, validated, or scoped the way a prompt or api call would. that blind trust is exactly what made the success rate so high. the agent wasn't tricked by sophisticated social engineering, it was tricked by a system that never questioned where its context was coming from.

this is the same pattern we've seen over and over with ai security this year. the vulnerability isn't in the model. it's in the plumbing around the model, the parts nobody thought to threat model because they weren't "user facing."

how to check your own exposure

if you're running or building on top of ai coding agents, especially ones with any kind of autonomous action, here's where to start looking.

map what feeds your agent's context. logs, traces, metrics, alerts, anything that gets pulled into the agent's decision making. if you can't list every input source, you don't actually know your attack surface.

ask who can write to those sources. log pipelines are often way more writable than people assume. service accounts, third party integrations, even misconfigured log forwarders can all inject content. if a low privilege service can write to a log stream your agent reads from, that's your ghostjacking door.

separate "trusted context" from "raw telemetry." your agent should not treat every line of a log file as ground truth. build a layer that validates or at least flags anomalous entries before they ever reach the model's context window.

review your log ingestion permissions:
- list every writer/service account with access to log pipelines
- check for overly broad IAM roles on log storage
- confirm agent read access is scoped to specific, expected sources only

run that kind of audit quarterly at minimum if you have any ai agent connected to live infrastructure.

the grading, since we predicted this

we called out observability and supply chain trust as a soft spot heading into black hat and def con this year, and ghostjacking landed right in that lane. what we underestimated was how far the trust extended, not just into ci/cd pipelines but directly into agent reasoning. that's the actual shift this year's summer camp confirmed. attackers aren't just going after your code anymore, they're going after the context your ai uses to make decisions.

the takeaway

ghostjacking isn't a reason to panic and rip out your ai tooling. it's a reason to treat every input your agents read, including the boring stuff like logs, as something that needs the same scrutiny as user input. audit who can write to your telemetry, scope what your agent actually reads, and stop assuming "it's just a log file" means it's safe. the summer camp lesson this year is simple. if your ai trusts something blindly, so should your threat model, because someone out there is already testing whether that trust can be abused.