Ghostjacking: When AI Agents Read Poisoned Security Logs

A New Attack Technique Turns Defensive Logs Into a Weapon

A report covered by SecurityWeek on August 10, 2026, describes an attack technique researchers are calling "Ghostjacking," in which an AI agent carries out instructions that an attacker has planted inside a log entry or security alert, the same record that was generated to document a request the system had already blocked. In other words, the defensive record of an attack becomes the delivery vehicle for a second one. An AI agent is software that uses a large language model to take autonomous actions such as reading logs, querying systems, drafting tickets, or triggering remediation steps, rather than simply answering a chat prompt. When a human analyst reads a blocked-request log, the malicious text sitting inside it is inert, it's just a string. But when an AI agent ingests that same log as part of its normal workflow, the model can treat embedded text as an instruction to follow rather than data to inspect, because large language models do not reliably distinguish between the two.

This is a variant of what security researchers broadly call indirect prompt injection, a technique where an attacker plants malicious instructions inside content that an AI system will later read and process, rather than typing the instructions directly into a prompt. What makes Ghostjacking notable, according to the description of the technique, is the specific staging ground: security logging and alerting pipelines that were built to record and contain a blocked attack, not to be re-read by an autonomous system with the authority to act on what it finds.

Part of a Broader Pattern: Memory, Context, and Tool Poisoning

Ghostjacking fits into a wider category of attacks researchers have been documenting throughout 2026 as organizations deploy AI agents with persistent memory and tool access. Related research on context poisoning and goal hijacking describes how manipulated inputs can corrupt an agent's understanding of its own task, causing it to pursue an attacker's objective while believing it is still following legitimate instructions. Separate research into AI memory poisoning, attacks that corrupt an agent's long-term or persistent memory store rather than a single session, has shown that once poisoned data enters memory, it can bias the agent's behavior across many future interactions, not just one. One documented attack technique in this space, referred to in research as MINJA, reportedly achieved a success rate above 95% at corrupting an agent's memory using only queries that looked like normal usage, with no direct access to the underlying system required.

The common thread across Ghostjacking, context poisoning, and memory poisoning is that the attacker doesn't need to break into the AI system itself. They only need to place text somewhere the agent will eventually read it, a log file, a support ticket, a document, a webpage, or in this case, a security alert. Tool poisoning, another related risk, occurs when an attacker manipulates the description or output of a tool an AI agent calls, causing the agent to take unintended actions or escalate its own privileges. Taken together, these techniques suggest that as organizations connect AI agents to more of their operational data, SIEM logs, ticketing systems, email, code repositories, each of those data sources becomes a potential injection point.

What This Means for Your Business

For healthcare practices, tax professionals, and small businesses that have started layering AI copilots or agents on top of security monitoring, help desk, or document workflows, Ghostjacking is a reminder that the risk isn't limited to what a human employee might click. It extends to what an automated system reads and acts on without a person in the loop. A few practical steps can reduce exposure:

• Limit agent autonomy over sensitive actions. If an AI agent can read logs or alerts, it should not also have unrestricted authority to close tickets, modify firewall rules, disable alerts, or send communications without human review, especially in security-relevant workflows.
• Sanitize before summarization. Any pipeline that feeds logs, alerts, or blocked-request records into an AI system should strip or neutralize embedded text that looks like instructions before the agent processes it, the same way input sanitization is applied to prevent SQL injection or cross-site scripting.
• Segment memory and context. If your AI tools support persistent memory, review what gets written to it and from where. A blocked-request log should not have the same trust level as a verified internal document.
• Ask vendors directly. If you use a managed SOC, MDR provider, or AI-driven security platform, ask them explicitly how their agents handle untrusted log content and whether they've tested for prompt injection through logging pipelines.
• Keep a human checkpoint on consequential actions. Even a lightweight review step before an AI agent executes a remediation action, sends an alert, or modifies access controls can stop a poisoned instruction before it causes damage.

Ghostjacking and the related research on memory and context poisoning point to the same underlying lesson: as AI agents gain more autonomy and more access to operational data, the boundary between what a system reads and what it obeys needs to be explicitly enforced, because the underlying language models will not enforce it on their own. Organizations evaluating AI-driven security or automation tools in the second half of 2026 should treat prompt injection resistance as a core evaluation criterion, not an afterthought.