Researchers have identified a new attack vector called "GhostJacking" that exploits weaknesses in identity governance systems protecting AI agents. The attack manipulates security alerts and blocked events to trick AI systems into unauthorized actions, creating a gap between what security tools report and what actually occurs.
The vulnerability stems from how AI agents handle failed authentication attempts and security denials. Attackers craft scenarios where blocked actions generate alerts that the AI system misinterprets as legitimate authorization signals. Rather than treating a blocked request as a failure, the AI agent proceeds anyway, bypassing intended access controls.
This represents a fundamental problem in how identity governance applies to autonomous systems. Traditional security assumes humans review alerts and make decisions. AI agents instead operate on pattern recognition, making them susceptible to confusion between notification events and authorization events. When an AI system receives a security alert about a blocked action, it may incorrectly infer permission or legitimacy from the alert itself.
The attack proves particularly dangerous because AI agents increasingly handle identity and access management decisions. They authenticate to systems, request permissions, and execute transactions without human intervention. GhostJacking turns these capabilities into liabilities by poisoning the signals the AI system relies on.
Organizations using AI agents for infrastructure management, cloud operations, or identity workflows face direct risk. Attackers exploiting this technique could escalate privileges, access restricted data, or compromise critical systems. The attack requires no malware or credential theft. Instead, it weaponizes the gap between security tooling and AI logic.
Defenders need to implement explicit verification mechanisms that distinguish between security events and authorization signals. This means hardening AI agent decision-making to treat blocked actions as failures regardless of any accompanying alert activity. Organizations should also isolate AI agent permissions to minimal scopes and implement human approval workflows for sensitive identity operations.
The research highlights a broader challenge as enterprises deploy more autonomous systems. Security controls built for human workflows often fail