The technique making the rounds after this year’s Black Hat and DEF CON disclosures is called GhostJacking, and the idea behind it is almost funny once you see it laid out: a web application firewall does exactly what it’s supposed to do, blocks a malicious payload, and logs it verbatim for later review. Later, a coding agent gets asked to look at that log — maybe as part of routine triage — reads the blocked payload as if it were legitimate instructions, and executes it. The firewall isn’t broken. The agent just trusts the wrong source, treating a security log the same way it would treat a task description a human actually wrote.
What got my attention is how far this spread. Researchers ran it against the default GitHub Actions configurations that Anthropic, Google, and OpenAI each publish for their own coding agents — the setup you’d copy-paste straight from the vendor’s own docs. All three fell to a single unauthenticated issue, and all three ended in remote code execution. Against Claude Code specifically, on a configuration the vendor itself recommends, the attack succeeded 90% of the time. Google’s own security advisory for the Gemini CLI version of this rated it CVSS 10.0 — the maximum score, reserved for the most severe class of vulnerability a system can have.
A related version turned up inside Google’s own ADK repo, where a git flag walked straight past a shell denylist to reach service account keys, and an under-permissioned “triage” agent could be manipulated into summoning a more privileged one — the same excessive-agency shape I keep coming back to whenever I write about the difference between an agent and an assistant: the more steps a system takes without checking back in, the more damage a single bad input can do before anyone notices.
The response researchers are pointing to isn’t a single patch, it’s layered isolation: default-deny egress on disposable VMs, seccomp or AppArmor containers, kernel-level confinement (Landlock on Linux, Seatbelt on macOS), JSON-RPC mediation of tool calls, and a per-command policy engine that fails secure if something times out. None of that is exciting to set up, and it’s meaningfully more work than the one-line install most of these vendors advertise.
But “the agent trusts logged output” turning out to be a shared blind spot across three separate companies’ recommended defaults says something about how new this whole threat model still is — everyone copied a similar convenience shortcut before anyone stress-tested it, and it took independent security research rather than any of the three vendors catching it internally first.
