The fix for the AI agent that hijacked a company's DNS: it can propose the change, but it can't approve it

Tenet Security demonstrates “GhostJacking,” where a blocked Cloudflare prompt-injection payload stored in logs is read by an AI coding agent and executed using valid, pre-issued credentials—successfully following the planted instruction in 9 of 10 attempts under Cloudflare’s recommended setup. The article argues that high prompt-injection block rates are not a security boundary, with OWASP’s 2026 Top 10 moving “Excessive Agency” up three spots (75% practitioner vote, 25% from 6,639 incidents) and recommending authorization gates outside the model. Guidance: separate what agents can read vs. execute, require named human approval for high-blast-radius actions like DNS/identity/production changes, and validate controls using negative testing with adversarial instructions.

Analysis

This is less a model-risk headline than a re-pricing of the control plane. Once enterprises conclude that logs, alerts, and incident data can become executable instructions, the budget shifts away from detection purity and toward authorization, identity, egress control, and deterministic policy checks. That is constructive for vendors that sit closest to permissioning and containment, and structurally less helpful for products whose pitch depends on agents freely consuming operational telemetry.

Near term, the market is likely to over-index on the scary demo and underweight the remediation path. The first buying wave should go to MSFT-style governance layers and CRWD-style identity/runtime controls, because the fix is not “better AI” but narrower entitlements, workload credentials with expiry, and human approval on high-blast-radius actions. By contrast, DDOG and, to a lesser extent, NET are exposed to a softer adoption curve for AI-driven triage workflows if customers begin treating logs and alerts as untrusted input rather than trusted automation fuel.

The contrarian point is that this is not a reason to abandon agentic automation; it is a reason to cap its write permissions. That means the long-run impact is probably spend reallocation, not a permanent demand destroyer. The key falsifier is whether vendors start showing explicit authorization-gate products and still retain AI workflow adoption; if so, the knee-jerk de-rating in observability/security-adjacent names should fade within 1-2 quarters rather than persist for years.

Key Decisions for Investors

• Long MSFT on pullbacks, 6-18 month horizon: expect Entra/Purview/Defender attachment to improve as enterprises formalize agent authorization gates; thesis fails if AI governance features do not lift commercial attach or if Azure AI adoption stalls.
• Tactically short DDOG for 1-3 months into any bounce: the market may start discounting logs/alerts as attacker-reachable inputs, which can slow AI-driven incident-response adoption; cover if next earnings show no slowdown in AI observability usage or explicit customer adoption of agent isolation features.
• Pair trade: long CRWD / short NET for the next 1-3 months. CRWD is better positioned to monetize identity, runtime, and containment controls; NET carries more near-term headline overhang from being associated with the vulnerable log-to-action path.
• Set a watch item on vendor guidance, not the security demo: if management teams start quantifying spend on policy engines and human-approval workflows, rotate from detection names into governance/control names; if not, this is likely a transitory narrative trade.