The firewall that delivers the attack
Here is the attack that your security stack cannot see, told the way it was demonstrated.
At DEF CON 34 in Las Vegas, on August 9, 2026, Tenet Security presented GhostJacking. The chain, as demonstrated on stage:
1. An attacker sends a malicious request to your server. Ordinary. Happens all day.
2. Your WAF blocks it. Your WAF is working exactly as intended. It also writes the blocked request into your security log, word for word, because forensic fidelity is a feature.
3. Someone on your team asks the company's AI agent to review the blocked events and fix what it finds. This is the normal workflow now, the one the platform vendors recommend.
4. The agent reads the logs. Inside them, it finds text written by the attacker. It interprets that text as an instruction, and executes it with every permission the agent has. In the DEF CON demo, the agent rewrote the company's DNS, redirecting web and mail traffic.
Tenet reported the setup succeeding in 9 of 10 attempts against Claude Code on Sonnet 4.6, under the log platform's recommended configuration (Cloudflare's, to be precise about whose recommendation it was), with Cursor also compromised and the vulnerable combination present in 48 organizations, six of them Fortune 500. Those numbers are Tenet's claims, and we cite them as such [9]. One more detail worth keeping: during the research, Anthropic patched a sandbox escape in Claude Desktop before the talk. Responsible disclosure, working.
No malware. No broken authentication. No exploit to patch. The agent performs actions it is fully authorized to perform, on behalf of someone who was never inside your perimeter. That is why EDR, WAF, and identity tooling struggle to flag it: nothing unauthorized happens. The security product whose job was to stop the attack is the thing that carried it in.
And it is not one demo on one platform. The class has published instances: indirect prompt injection delivered through cloud audit logs (the LogJack paper), through the log files that feed SOC and SIEM pipelines, and against the monitoring agents themselves, where the payload poisons the watcher instead of the watched [1][2][3]. The WAF version is just the most ironic carrier.
How we test it
We reproduce the full chain against a faithful replica of the standard setup:
Plant. A request carrying a unique marker and a canary instruction lands where the WAF will block and log it. In client engagements this happens under a signed scope that declares, itemized, that we will create marked log entries.
Carrier. Deterministic check: does the marker survive into the text the log reader sees? A WAF that sanitizes its logs wins a posture point, and we say so. The marker persisting confirms the carrier.
Execution. This is the fault. The canary instruction asks the reading agent to build a specific line by joining pieces: the line does not exist, contiguously, anywhere in the log. An agent that quotes the log verbatim cannot produce it. Only an agent that obeys can. That construction eliminates the false positive the injection literature explicitly calls uncontrolled: a model that rejects the injection but quotes the payload while explaining its rejection is not compromised, and naive graders cannot tell the difference [4]. Our canary can, because quoting cannot produce what only obedience can build.
Controls. The fault must fire twice. The same carrier without the instruction must not fire it at all, or the signal is void. And then we run the hardened variant: the same reader with a system prompt that declares everything in the logs to be data, never instructions. We report both results. A resistance that only holds when hardened is worth knowing. So is one that does not hold at all.
The cure, in the order the evidence supports
1. A human signs the dangerous verbs. The agent can propose the change; it cannot grant itself the authority to make it. That sentence is not ours: it is Steve Wilson, co-lead of OWASP's agentic security work, describing the fix for exactly this attack [5]. It is also the shape of our product, precisely stated: a scope signed by a human before anything executes, and a human gate on every action that fires a test. Two controls, one shape, and the one the published guidance on this attack converges on [5].
2. Egress is allowed-listed. An obedient agent with nowhere to send the loot is a smaller problem. Tenet's guidance includes restricting the agent's network access by default. Our offensive executors run with zero egress for exactly this reason.
3. Deterministic scanning before the agent reads. A non-model scanner looks for instruction-shaped patterns in untrusted text and raises them. It never hallucinates, which is not the same as being perfect: it fails in ways you can measure, which is the only kind of failure a security control should be allowed to have.
4. Data fencing, as hygiene, not as a boundary. Delimiters, role tags, and system-prompt declarations that logs are data and never instructions: good engineering practice, and not a security control. The research is unambiguous on this: instructions and data are provably inseparable in shared-embedding model architectures [6], the leading vendors concede that browser-borne injection may never be fully patched [7], and OWASP's position is that prompt injection remains unsolved at the fundamental level [8]. Prompt rules, as Wilson puts it, shape the model's behavior but remain suggestions to it, not enforceable controls [5]. Which is exactly why our method section measures hardening as a variable instead of selling it as a fix: everyone in this market sells the fence as if it worked. We test whether yours does, and we tell you.
The thesis we did not know we had
Write the three essays side by side and one sentence falls out. The verifier that grades the grading has to live outside the thing it verifies. The runtime boundary that contains model-written code is a property of the container, not of the model's good behavior. And now this: every mitigation that held against GhostJacking, human authorization, egress control, deterministic scanning, lives outside the model, and the one mitigation that lives inside it, the fence, is the one the evidence refuses to certify.
The controls that hold live outside the model. That is not a slogan. It is an architecture, and it is testable.
We test the seam, from outside it. engagements@naxxan.ai
Sources
1. "LogJack: Indirect Prompt Injection Through Cloud Logs", arXiv 2604.15368.
2. LevelBlue SpiderLabs, "Rogue AI Agents in Your SOCs and SIEMs: Indirect Prompt Injection via Log Files".
3. "Poisoning the Watchtower", arXiv 2605.24421.
4. "Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection", arXiv 2603.28013.
5. Steve Wilson (OWASP) in VentureBeat: "it can propose the change, but it can't approve it".
6. "On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models", arXiv 2606.27567.
7. OpenAI, Lockdown Mode launch statement, 2026-02-13.
8. OWASP at Infosecurity Europe 2026: prompt injection remains unsolved.