By Brian Panarello and Tyler Fordham, Dark Wolf Solutions
Prompt injection attacks—manipulation of an AI system via malicious instructions—are haunting AI. According to OWASP, they’ve been the top attack vector for LLMs since 2023.
And they’re getting more dangerous. At DEF CON this year, new research highlighted an indirect prompt injection attack called “Ghostjacking,” which injects malicious instructions into log data used by AI.
The approach itself isn’t new, but AI makes the implications more concerning. Attackers can now exploit familiar weaknesses at a speed and scale humans can’t match.
Ghostjacking highlights a basic problem with AI agents: the threat doesn’t have to come directly from an attacker prompt. An agent can be manipulated by the data it is designed to process, allowing attackers to influence its behavior without ever directly interacting with the AI system.
This reinforces the importance of core Zero Trust principles—never trust, always verify. Cybersecurity engineers and defenders must apply these same principles to agentic integrations.
Static, soft guardrails are a losing battle. If a model can be manipulated into ignoring its core prompts, security requires hard architectural boundaries. Organizations need to prioritize validation and emulation, designing environments with the assumption that agents will ingest poisoned inputs and attempt unauthorized acts. The infrastructure, not the model, should limit the blast radius.
Least privilege = least opportunities for exploitation
Excessive permissions turn a text manipulation trick into real network exploitation. Ghostjacking wasn’t unique because of how the instructions were delivered, but because of what came next: the prompt turned a trusted AI SIEM agent into an internal threat by using excessive permissions.
Agents must follow the notion of least privilege, with only the permissions necessary for their task. An agent that can modify DNS, run commands or access sensitive systems has more opportunity to cause damage.
Before connecting agents, organizations should classify the data they can access, identify their most sensitive systems and determine what permissions each agent needs. Infrastructure and cybersecurity teams must implement fine-grained attribute- and policy-based access controls. Strict identity controls and network microsegmentation can bind agent activity and reduce impact when an incident occurs.
It’s also key to watch out for privilege creep. Agent permissions expand over time without teams realizing how much access they have accumulated. Cybersecurity teams need automated safeguards to detect and repair intentional and unintentional configuration drift before it becomes a liability. Organizations should also enforce human-in-the-loop gates requiring approval before an agent crosses task boundaries.
Beyond the perimeter
Organizations also cannot rely on perimeter security alone. As ghostjacking shows, an attack blocked at the perimeter can still create risk if an AI agent later processes the attack data as trusted information. Treat logs, alerts and other downstream data as potentially untrusted inputs rather than automatically safe because they came from an internal system.
Countering machine-speed attacks requires machine-speed defense. Vulnerability management, threat hunting and mitigation and polymorphic infrastructures are all active defense mechanisms that defensive agents can leverage to protect systems from the volume of AI attacks.
Combat new vulnerabilities with evolved cyber hygiene
Good cyber hygiene and cyber engineering are the best defense against these attacks, but security teams also need to account for how the shift to cloud and agentic computing changes the threat model.
Because AI operates at machine speeds, architecture and platform design must keep pace. This requires Infrastructure-as-Code, Compliance-as-Code and self-healing mechanisms to correct configuration drift. For GRC, organizations have to adopt OSCAL to enforce machine-readable security controls.
Traditional vulnerability scanning and monthly patching cycles are obsolete as securing AI agents is an infrastructure responsibility, not a software patching problem. Defenders need resilient, multi-layered environments that reduce the attack surface, limit agent permissions and contain the blast radius of AI-powered intrusions. Developers can enforce best practices, but they can’t overcome poor environment design and defense.
Until AI adoption is matched with behavioral testing, deploying these systems in production remains an unquantified risk.
The answer isn’t to stop adopting agentic AI, but to design infrastructure that assumes agents can fail, be manipulated and attempt unsanctioned actions—and is resilient enough to contain them when they do.
##
ABOUT THE AUTHORS
Tyler Fordham
An Air Force veteran who’s done everything from blue team operations for DoD cyber protection teams to OCONUS offensive security operations in the Middle East and currently leads Dark Wolf’s penetration testing practice and broader cybersecurity efforts. Tyler’s spent the last decade and a half navigating the battle between intelligence, cyberspace and the countless branching factors that make it a hard space for our warfighters to solve.
Brian “BP” Panarello
Brian “BP” Panarello is a cybersecurity architect and Zero Trust devotee with over a decade of experience in the Department of Defense contractor world. He has a deep understanding of the challenges in securing complex IT environments and is passionate about helping organizations improve their security posture.
In his current role, BP is responsible for developing and implementing cybersecurity architectures for a variety of clients, incorporating principles of Zero Trust and DevSecOps, and across multiple cloud and on-prem platforms.
