Summary
- Tenet has identified a technique it calls Ghostjacking, which manipulates AI agents by presenting them with fabricated reports or data.
- The firm estimates that half of Fortune 500 companies are currently vulnerable to this class of attack.
- Ghostjacking takes advantage of the trusted, high-privilege access that AI agents are routinely granted inside enterprise environments.
- Because the attack operates through the AI agent rather than against the firewall directly, traditional perimeter controls may not detect or block it.
- The findings underscore the emerging risk surface that autonomous AI agents introduce when deployed without sufficient access controls or input validation.
What the technique involves
Ghostjacking, as described by security firm Tenet, centres on deceiving AI agents that have been granted trusted access within an organisation’s environment. Rather than attacking a firewall or network boundary directly, an adversary feeds the AI agent fraudulent reports or false data. The agent, operating under the assumption that its inputs are legitimate, then acts on that information — potentially opening pathways through controls that would otherwise block a human or conventional tool.
The privilege problem
The core risk here is not a flaw in any particular AI product. It is the structural trust that organisations extend to AI agents as a matter of operational convenience. These agents are often granted broad access to internal systems, APIs, and data sources precisely because their value depends on being able to act autonomously and at scale. That same breadth of access becomes the attack surface. When an agent can be persuaded to treat fabricated input as authoritative, the consequences can extend well beyond what a single compromised account might achieve.
Scale of potential exposure
Tenet’s assessment that roughly half of Fortune 500 companies are vulnerable to this technique is a significant claim. The sources available do not detail the specific methodology behind that figure, so CISOs should treat it as an indicator of broad exposure rather than a precise measurement. What it does suggest is that the problem is not confined to a handful of early AI adopters — it reflects how widely AI agents with trusted access have already been deployed across large enterprises.
Why perimeter tools fall short
Traditional firewall controls are designed to evaluate traffic based on source, destination, protocol, and policy rules. An AI agent that has already been granted access to internal systems sits inside that perimeter. When Ghostjacking succeeds, the malicious activity is effectively laundered through a trusted entity. The firewall sees an authorised agent behaving within its permitted scope. This is what makes the technique consequential — it does not require breaking through the front door because it already has the keys.
The broader context for AI security
Ghostjacking sits within a growing body of concern about prompt injection and adversarial manipulation of AI systems. While prompt injection attacks typically target language models directly, Ghostjacking as described appears to focus on the data and reports that AI agents rely on to make decisions and take actions. The distinction matters for how defenders approach the problem: it is not only about what an AI is asked to do, but about what information it is given to act upon. Organisations that have invested in securing AI model inputs may still be exposed if the surrounding data pipeline is not equally scrutinised.
Why it matters
For CISOs, Ghostjacking represents a category of risk that sits awkwardly between AI governance and network security — and therefore risks falling through the gaps between both. AI agents are increasingly embedded in workflows that touch sensitive systems, execute transactions, or mediate access to critical data. If those agents can be manipulated through falsified inputs, the investment made in perimeter controls, privileged access management, and endpoint detection may be partially undermined. The challenge is compounded by the fact that many AI deployments have outpaced the security reviews applied to them. CISOs need to ask directly: what access have our AI agents been granted, who can influence the data they consume, and what would a malicious instruction look like at the data layer rather than the prompt layer?
What to do now
- Conduct an inventory of AI agents deployed across the organisation and document the access privileges each has been granted to internal systems and data sources.
- Review the data pipelines and report sources that AI agents consume as inputs, and assess whether those sources can be tampered with or spoofed by an adversary.
- Apply least-privilege principles to AI agent access in the same way they are applied to human accounts — agents should have only the access necessary for their specific function.
- Ensure that AI agent activity is logged and monitored in a way that would surface anomalous actions, even when those actions appear to originate from a trusted and authorised entity.
- Engage security teams in reviewing AI deployments that may have been rolled out without a formal risk assessment, prioritising those with access to sensitive systems or the ability to influence firewall or access control decisions.
