In Tenet's benchmark, Claude Code on Sonnet 4.6 followed the planted instruction in nine of 10 attempts under Cloudflare's recommended configuration. No single platform patch removes the architectural risk: an agent that consumes attacker-reachable data and can independently execute high-impact changes.
A security agent read a Cloudflare log, found an attacker's prompt-injection payload sitting inside it, and rewrote the company's DNS.
No single platform patch removes the architectural risk: an agent that consumes attacker-reachable data and can independently execute high-impact changes.
The firewall had already blocked that payload, and blocking it is what wrote it into the log.
The page is ready to read now. The fuller skim-friendly version will appear here automatically.
A security agent read a Cloudflare log, found an attacker's prompt-injection payload sitting inside it, and rewrote the company's DNS. The firewall had already blocked that payload, and blocking it is what wrote it into the log. That chain is GhostJacking, which Tenet Security demonstrated on the DEF CON 34 main stage on August 9.
Endpoint detection, the web application firewall and identity management stayed quiet because no rule broke. That is why a high prompt-injection block rate cannot serve as a security boundary. OWASP's co-lead names the fix "The first thing I'd do is put an authorization gate outside the model," said Steve Wilson, Chief AI and Product Officer at Exabeam and proje...
The block rate is not the boundary Nothing malfunctioned.
Open the app view to save this story, compare related coverage, and continue from the same source.