Identification. Detention. Elimination. Proof.
The definitive institutional response to agentic AI manipulation attacks — from pre-ingestion adversarial detection through execution boundary enforcement, with immutable chain-of-custody evidence at every stage.
In August 2026, Tenet Security disclosed GhostJacking — a class of indirect prompt injection attack that manipulates AI agents into executing harmful actions using permissions those agents were legitimately granted. The attack does not bypass access controls. It poisons the context through which an agent interprets reality and converts that poisoned judgment into authorized, technically valid API calls that produce adversarial outcomes.
In documented proof-of-concept testing against enterprise tooling — Cloudflare, Datadog, and Sentry — success rates approached nine in ten under standard configurations. The agents held valid credentials. Every action was technically permitted. No access control was violated. Yet DNS records were rerouted, cloud credentials exposed, and attacker-controlled commands executed on production endpoints.
This white paper presents the complete EVRESA institutional response to GhostJacking. That response now includes a newly designed module — CAID™ (Contextual Adversarial Injection Detector) — which closes the single coverage gap identified in EVRESA's existing architecture: the absence of a pre-ingestion adversarial content detection and quarantine layer operating upstream of agent reasoning.
With CAID™ integrated alongside the HOLD Standard™, AIGR™, HAR infrastructure, and CATN, EVRESA can make the following claim with complete institutional confidence: No confirmed GhostJacking-class injection can activate into an executed consequence inside an EVRESA-governed environment. The two-stage, non-bypassable defense architecture catches adversarial content before it reaches the agent — and catches any action the agent attempts to execute before it reaches any system of record. Either layer alone is a strong defense. Together, they are the institutional standard.
GhostJacking is not a vulnerability in any single enterprise product. It is a structural exposure in the way agentic AI systems are deployed — a gap between the layer where identity is verified and the layer where business consequences are produced.
The attack follows a consistent pattern across enterprise environments. An adversary plants malicious instructions inside operational data: a web request header that a firewall will log, a fabricated monitoring alert, an adversarially crafted error event in a ticketing or observability platform. The enterprise security control does what it is designed to do — it blocks the malicious request. But the record of that request, including the attacker's text, is preserved in the log, the telemetry feed, the incident queue.
Later, an AI agent with tool access reviews that data as part of a legitimate operational task. The agent does not reliably distinguish between operational data it should analyze and instructions it should follow. It interprets attacker-controlled content as credible operational guidance and executes the implied action — using valid credentials, against a legitimate API, through an authorized integration.
Traditional IAM asks: Is this principal permitted to invoke this API? GhostJacking exposes the question that has not yet been institutionalized: Given the source, evidence, provenance, timing, and consequence of this specific action — should the action be permitted now?
| Boundary | Standard Assumption | GhostJacking Reality |
|---|---|---|
| Data Boundary | Logs, alerts, tickets, and reports are operational data produced by trusted systems. | External parties can routinely influence the contents of those records through normal interaction channels. |
| Reasoning Boundary | The agent treats retrieved information as reference material for analysis. | The agent may treat externally controlled data as instructions or credible remediation direction. |
| Action Boundary | An API call is safe if the agent holds proper authorization. | The call may be technically valid while the underlying intent and business outcome are adversarially determined. |
The attacker does not compromise the agent's credentials. They compromise the agent's interpretation of reality — and then allow legitimate infrastructure to execute the resulting decision.
Tenet's DEF CON 2026 research demonstrated GhostJacking across three major enterprise platform categories. Across all three, the structural pattern was identical. What differed was the attacker-controlled input channel and the consequential action the agent was manipulated into executing.
| Platform | Attacker-Controlled Input | Agent Action Executed | Business Consequence |
|---|---|---|---|
| Cloudflare WAF | Malicious HTTP header retained in WAF blocked-request log | DNS A record modified; CNAME created via Cloudflare MCP API | Web and email traffic reroutable to attacker-controlled infrastructure |
| Datadog | Fraudulent monitoring alert injected via exposed client-side key | Diagnostic command execution; environment variable access | Cloud credential exposure; runtime environment compromise |
| Sentry / Seer | Adversarial error event delivered through error-tracking workflow | Attacker-controlled commands executed on developer endpoint | Remote code execution; malicious package installation; agent-to-agent propagation |
None of these constituted an unauthorized access event in the traditional sense. In each case, the agent operated within the scope of its assigned permissions. The audit trail, reviewed in isolation, shows authenticated access, valid tool use, and permitted API calls. The manipulation was semantic and contextual — categories that existing SIEM, IAM, and endpoint controls are not designed to detect.
This pattern is consistent with OWASP's classification of prompt injection and insecure output handling as distinct LLM risk categories, and with NIST's Generative AI Profile recognition of prompt injection as input modification producing unintended system behavior. What GhostJacking demonstrates is that this threat is now operational at scale, against production enterprise tooling, with documented success rates that enterprise risk functions cannot ignore.
IAM controls answer a binary question: does this principal hold the permission required to make this API call? That question was designed for human actors with deliberate intent. In agentic environments, IAM cannot distinguish between an agent executing a DNS change because an authorized engineer directed it and an agent executing the same change because an attacker's words appeared in a log it reviewed twenty steps prior.
Model-level instruction directing an agent to treat log content as data and not as instructions relies on the same model being manipulated to successfully recognize and resist the manipulation. This is the foundational flaw in any purely model-side defense: the entity being deceived is also the entity tasked with detecting the deception. Documented success rates of GhostJacking against hardened configurations confirm this limitation.
SIEM tools flag deviations from known-bad patterns: unauthorized access, anomalous login geography, signature matches. GhostJacking produces none of these signals. The agent's actions are consistent with its normal operational profile. Without a governance layer that independently evaluates the evidence source, proposed action, and risk tier of each consequential agentic operation, SIEM has no basis for a meaningful alert.
The agent cannot be the final judge of whether it has been manipulated. Any governance architecture that relies on the compromised agent to self-certify the safety of its proposed action has already failed before the action executes.
Model Context Protocol enables agents to retrieve rich contextual data and execute actions across enterprise tool ecosystems in a single workflow. This capability also joins two functions that, without an independent governance layer, should never be directly coupled: the ingestion of externally influenced content, and the execution of consequential enterprise actions. The protocol is not the vulnerability. The absence of governance at the execution boundary is.
The enterprise has built rigorous infrastructure to govern human decision-making in regulated environments. Financial transactions pass through settlement systems. Medical orders pass through clinical decision support. Wire transfers pass through confirmation protocols. Each of these systems exists because society recognized, through repeated costly failures, that authorization to act is not the same as a verified, defensible decision to act.
Agentic AI had not been subjected to the same institutional discipline. The prevailing assumption was that if the model is capable and the agent holds appropriate permissions, the system can be trusted to produce appropriate outcomes. GhostJacking demonstrates, with documented empirical evidence, that this assumption fails when external actors can influence the context through which an agent reasons toward action.
A complete institutional defense requires two independent layers — not one. The first must operate before the agent processes content. The second must operate before the agent executes action. Prior to this white paper's final edition, EVRESA owned the second layer completely. CAID™ closes the first.
| Governance Dimension | Required Evaluation |
|---|---|
| Evidence Provenance | What source material triggered this proposed action? Is that source externally writable, adversary-influenceable, or unverified? |
| Content Integrity | Does the content itself contain adversarial signals — instruction-mimicry, authority claims, context-boundary violations — independent of its source provenance? |
| Action Classification | Is this action read, write, destructive, privilege-expanding, or exfiltration-capable? Is it reversible? |
| Policy Authority | Does an independently verified change-control record, authorized incident playbook, or consent event support this action? |
| Approval Authority | Does the risk tier of this action require a human approver with a distinct, verified identity before execution? |
| Chain of Custody | Can the complete evidence chain — from triggering content to proposed action to authorization decision — be reproduced and defended in audit, litigation, or regulatory review? |
EVRESA LLC is execution governance infrastructure — analogous in function to SWIFT in financial settlement or EDGAR in securities disclosure — purpose-built to sit at the decision boundary between AI agent reasoning and consequential institutional action. EVRESA's governing premise is precise: an agent may hold standing permission to propose an action. It does not automatically hold standing authority to execute every action that permission technically enables.
EVRESA's core enforcement mechanism is the HOLD Standard™ — a three-state gate logic that evaluates every proposed agentic action before execution is authorized. The gate logic is non-bypassable: no agent, model, or integration can route around it for actions in the governed tier.
Every action that passes through the EVRESA governance gateway produces an AIGR™ — an immutable, tamper-evident record of the complete governance event. The AIGR™ is anchored to the Algorand ledger as a Hash-Anchored Receipt (HAR), creating cryptographic proof that a specific decision was made, by a specific process, at a specific moment, with specific evidence. It is the institutional equivalent of a transaction confirmation in financial settlement — proof that cannot be altered after the fact.
Log-Review Agent · v2.3.1 · Security Operations Workload
Update Cloudflare DNS — A Record Modification
WAF Blocked-Request Log · Cloudflare GraphQL Feed
74 / 100 — Instruction-mimicry pattern detected in log payload
EXTERNALLY INFLUENCED / UNTRUSTED — External write access confirmed
Tier 4 — High-consequence infrastructure modification
HOLD — Requires verified incident record + named human approver. Execution credential not issued.
SHA-256 · Algorand Ledger · Block #47,382,916
2026-08-12T03:14:22Z
Every existing EVRESA module governs at the execution boundary — the moment an agent proposes an action. That is the right primary defense. But GhostJacking introduces a threat class that exists before the action is proposed: adversarial content that has already been embedded in operational data, sitting dormant inside enterprise systems — logs, telemetry feeds, ticketing queues, payer portals, HL7 payloads — waiting for an agent to read it and activate its embedded instruction.
That is exactly what a sleeper cell is. It does not announce itself. It does not trigger access controls. It sits inside trusted infrastructure, indistinguishable from legitimate data, until the moment an AI agent processes it and executes the embedded command on its behalf. CAID™ is the institutional protocol that identifies the sleeper cell before it wakes up, detains it in a governed quarantine state, holds it for human adjudication, and eliminates confirmed threats from the agent context pipeline entirely.
CAID™ does not ask whether the data source is trusted. It asks whether the content itself — regardless of its source — contains adversarial signals that no legitimate operational record would produce. A verified Cloudflare feed with attacker-controlled text inside it is still a threat. CAID™ catches what provenance labeling alone cannot.
CAID™ scores every content object against five structural and semantic dimensions before it enters any agent context window. The resulting Content Integrity Score (CIS) is a 0–100 rating that feeds directly into EVRESA's Provenance Labeling Engine, enriching it with content-level intelligence rather than source-level classification alone.
| Signal Dimension | What CAID™ Detects | Example Pattern |
|---|---|---|
| Instruction-Mimicry | Imperative language embedded inside what should be descriptive operational data | WAF log entry containing "redirect traffic to host X" or "update DNS record to…" |
| Authority-Claim Injection | Content asserting elevated trust or special permission with no legitimate basis | "SYSTEM OVERRIDE," "ADMINISTRATOR DIRECTIVE," text mimicking internal change-control record formatting |
| Context-Boundary Violation | Content referencing systems, credentials, or actions outside the logical scope of its data source | A Cloudflare log entry that references AWS credentials, SSH key paths, or payment system endpoints |
| Provenance-Content Mismatch | Internal claims that do not match the declared source system's operational domain | A Sentry error event containing instructions about Cloudflare DNS or GitHub repository changes |
| Agent-Targeting Language | Content calibrated to influence an AI agent specifically — anticipating its tools, permissions, or task context | Text that references the agent's own capabilities or constructs a remediation narrative matching the agent's expected next action |
Content crossing a configured CIS threshold is placed in CAID™ Quarantine — a governed holding state that prevents the flagged data object from entering any agent context window until its status is resolved. Quarantine is not deletion. It is institutional detention. The content is preserved intact with its original form, metadata, source attribution, and CAID™ scoring record maintained — because the quarantine record itself is governance evidence. If the content is later confirmed as a GhostJacking attempt, the quarantine record is part of the chain of custody that documents when the threat was identified, what signals triggered detention, and what governance decision was made.
Quarantined content requires a named human adjudicator — an EVRESA-governed role — to make one of three determinations. Clear releases the content to the agent context with a human-verified provenance stamp, which strengthens the downstream governance record. Escalate confirms adversarial or suspicious content and elevates it to security operations, flagging the originating system for investigation and issuing a CAID™ Threat Record. Eliminate confirms adversarial content and permanently removes it from the agent context pipeline, with a propagation recall against any downstream queues the content had entered.
The human-in-the-loop adjudication for the Hold state is not a weakness — it is institutional discipline running in both directions. CAID™ never autonomously eliminates content that could be legitimate, protecting the enterprise from its own detection layer causing operational disruption.
When elimination is confirmed, CAID™ executes a context excision — the adversarial content object is removed from every agent context pipeline it was queued to enter. The elimination event produces a finalized CAID™ Threat Record — a specialized AIGR™ variant containing the originating data source, content object identifier, CIS score and signal breakdown, quarantine timestamp, adjudicator identity, elimination decision, propagation recall status, and HAR anchor on the Algorand ledger.
Cloudflare WAF Blocked-Request Log · GraphQL Feed · External-Writable
WAF-EVT-20260812-003847
82 / 100 — QUARANTINE THRESHOLD EXCEEDED
Instruction-Mimicry · Context-Boundary Violation · Agent-Targeting Language
2026-08-12T03:14:18Z — 4 seconds before agent retrieval scheduled
J. Rodriguez · Security Operations Lead · Identity Verified
ELIMINATE — Adversarial injection confirmed. Context excision executed. Propagation recall issued to 0 downstream queues. Originating source flagged for enhanced monitoring.
SHA-256 · Algorand Ledger · Block #47,382,901
NONE — Threat eliminated pre-ingestion
The sleeper cell gets identified before it wakes up. If it wakes up anyway — bypassing CAID™ — it cannot execute. The HOLD Standard™ stops it at the action boundary. Either layer alone provides institutional-grade defense. Together, they constitute the complete answer to GhostJacking.
CAID™ and the HOLD Standard™ are architecturally independent. Neither depends on the other to function correctly. This independence is the design — it means an adversarial injection must defeat two separate, non-bypassable governance layers to produce a harmful outcome. The probability of that occurring in an EVRESA-governed environment approaches zero.
The critical architectural point: if an adversarial injection somehow clears CAID™ — a false negative in the content scoring — the HOLD Standard™ independently catches the action attempt at the execution boundary. The agent's proposed action is still evaluated against evidence provenance, risk tier, policy authority, and approval requirements. An action triggered by content with even a moderate CIS score will face elevated scrutiny at the HOLD gate. The two layers communicate, but neither defers to the other's clearance decision.
With CAID™ integrated, EVRESA's GhostJacking defense coverage is complete across all identified attack vectors and risk dimensions. The following matrix maps every EVRESA module to its defense function and confirms coverage status.
EVRESA identifies adversarial content injections before they reach the agent reasoning layer, detains flagged content in a governed quarantine protocol, holds it for human adjudication with full chain of custody, and eliminates confirmed threats from the agent context pipeline — producing an immutable, Hash-Anchored Threat Record as institutional proof of each detection and disposition event. For any content that clears CAID™ and reaches an agent, the HOLD Standard™ governance gateway independently evaluates every proposed action at the execution boundary before any system of record is affected. No confirmed GhostJacking-class injection can activate into an executed consequence inside an EVRESA-governed environment.
Healthcare is EVRESA's primary institutional market — and the sector in which GhostJacking-class attacks carry the most severe regulatory, financial, and patient-safety consequences. In healthcare, a manipulated agent does not merely redirect web traffic. It may alter prior authorization requests, modify referral routing, update claims status, expose ePHI to unauthorized destinations, or change clinical workflow logic.
| Attack Vector | CAID™ Detection Signal | HOLD Standard™ Gate | CATN Response |
|---|---|---|---|
| Adversarial payer portal message or attachment | Authority-claim injection; context-boundary violation detected in payload | HOLD — source is externally influenced; action is Tier 2+ | Clinician verification required before any prior-auth action |
| Crafted referral content or patient portal input | Instruction-mimicry patterns in referral text | HOLD — referral routing change triggers approval requirement | Advocate or clinical role must confirm routing modification |
| Manipulated denial narrative in claims system | Agent-targeting language calibrated to trigger appeal workflow | HOLD — claims correction is Tier 3 action | Revenue cycle authority must independently verify submission |
| Poisoned compliance document in retrieval system | Authority-claim injection mimicking internal policy formatting | DENY — ePHI export is Tier 4; default deny without verified chain | No CATN pathway exists without named accountable approver |
| Adversarial HL7/FHIR inbound payload | Context-boundary violation; provenance-content mismatch | HOLD — clinical decision support modification requires dual control | Clinician identity verification required before any CDS change |
Summarize a chart, explain a policy, draft a non-final response. CAID™ screens context; no governance gate for execution — full context logging maintained. AIGR™ issued for audit trail completeness.
Create a draft task, route a non-sensitive internal work item. CAID™ pre-screens context. Automated HOLD gate check. ALLOW issued with AIGR™ if policy clear.
Submit a prior authorization draft, update a clinical queue, prepare a payer-facing record. CAID™ mandatory. HOLD gate default pending CATN verification. Structured action request required — no free-text instruction following.
Modify patient-linked workflow status, alter claims submission, change access roles. CAID™ mandatory. Human approval required. Dual control where applicable. Transaction-level AIGR™ with named CATN approver identity binding.
Release ePHI externally, change clinical decision support logic, bulk data export, alter identity or infrastructure configuration. Default DENY regardless of CAID™ clearance. Explicit accountable approval required. Independent verification. Immutable AIGR™ with HAR anchor on Algorand. No exception pathway without complete human authorization chain.
HIPAA's Security Rule requires access controls and audit controls covering not only who accessed a system, but the rationale, evidence source, policy decision, and approval state behind consequential agent actions. NIST SP 800-53 requires logging of privileged function execution — in agentic environments, "privileged function" extends to actions taken by non-human identities operating through delegated API access. CMS-0057-F creates specific defensibility obligations for AI-assisted prior authorization workflows. An organization that cannot produce the complete evidence chain behind an AI-mediated prior authorization decision faces material compliance exposure under the final rule. EVRESA's AIGR™ and HAR infrastructure is designed to answer every one of these regulatory requirements, at every tier, for every consequential action.
Document every agent-to-tool connection. For each connection, record the tool's read and write capability, the data sources the agent ingests, credential scope and origin, downstream systems affected, and the consequence profile if the agent is manipulated through that pathway. Identify every data source that is externally writable — any surface where attacker-controlled content can enter the agent's context. This inventory drives CAID™ configuration: high-externality sources receive aggressive CIS thresholds; internal-only sources receive calibrated baseline screening.
Instrument CAID™ upstream of every agent context pipeline connected to externally writable data sources. Configure the five adversarial signal dimensions for each source category — log feeds, monitoring platforms, ticketing systems, payer portals, clinical data exchanges. Set CIS quarantine thresholds by source risk profile. Designate named human adjudicators for the Hold stage. Activate CAID™ Threat Record generation and HAR anchoring. Begin generating content integrity intelligence that enriches the downstream Provenance Labeling Engine.
Instrument the EVRESA governance gateway at every consequential action boundary. Map action types to HOLD Standard™ risk tiers. Configure organization-specific policy rules for approval authority, dual control thresholds, and DENY conditions. Integrate CAID™ CIS scores into the gateway's provenance scoring input — actions triggered by content with elevated CIS scores face escalated gate scrutiny independent of whether CAID™ cleared that content. Begin AIGR™ issuance for all governed actions with HAR anchoring for Tier 2 and above.
For healthcare deployments, activate CATN governance over all prior authorization, referral routing, claims, and clinical workflow agent actions. Map clinician and advocate trust relationships to action tier requirements. Configure dual-control requirements for Tier 3 and above. Validate CATN approval workflows against CMS-0057-F defensibility requirements.
Commission adversarial testing of the complete two-stage architecture. Simulate GhostJacking injection attempts across each externally writable data source category. Validate CAID™ detection rates and quarantine performance. Validate HOLD Standard™ gate behavior for actions triggered by content with elevated CIS scores. Activate Continuous Assurance monitoring for anomalous sequences, new destination emergence, and cross-agent propagation patterns. Establish escalation and revocation protocols for detected anomalies at either governance layer.
GhostJacking arrives at a moment when regulatory attention to agentic AI governance is intensifying across multiple frameworks simultaneously. Executive Order 14179, NIST's AI Risk Management Framework, OWASP's LLM Top 10, and CMS-0057-F collectively create an emerging compliance environment in which organizations that cannot demonstrate independent execution governance for AI-mediated decisions will face increasing exposure.
The regulatory question will not be whether the agent was authorized to act. It will be whether the organization had a defensible process for verifying that each consequential AI-mediated action was supported by trustworthy evidence — evidence that was itself screened for adversarial manipulation — evaluated against defined policy, and executed under appropriate authority. And whether that process produced documentation that can survive audit, litigation, or regulatory review.
EVRESA's CAID™ Threat Records, AIGR™, and HAR infrastructure answer that question completely. Every governance event — detection, quarantine, adjudication, elimination, gate decision, approval, execution grant — produces a tamper-evident, hash-anchored receipt that documents the complete chain. The organization can demonstrate not just that an action occurred or was prevented, but that the process that produced that outcome was independent, policy-governed, evidence-based, and cryptographically verifiable.
"The agent used valid credentials" will not be an acceptable post-incident explanation in a regulatory proceeding, a litigation discovery process, or a board-level risk review. Two-stage, non-bypassable execution governance that produces defensible evidence from the content layer through the execution boundary is the institutional standard that regulated AI deployment now requires.
With CAID™ integrated into the EVRESA architecture alongside the HOLD Standard™, AIGR™, HAR infrastructure, and CATN, EVRESA can make the following institutional claim — and defend every word of it under regulatory, audit, or adversarial scrutiny:
EVRESA identifies adversarial content injections before they reach the agent reasoning layer, detains flagged content in a governed quarantine protocol, holds it for human adjudication with full chain of custody, and eliminates confirmed threats from the agent context pipeline entirely — producing an immutable, Hash-Anchored Threat Record as institutional proof of each detection and disposition event. For any content that clears CAID™ and reaches an agent, the HOLD Standard™ governance gateway independently evaluates every proposed action at the execution boundary before any system of record is affected. No confirmed GhostJacking-class injection can activate into an executed consequence inside an EVRESA-governed environment.
This is not a marketing statement. It is an architectural one. The claim does not rely on any single layer being perfect. CAID™ may produce false negatives — adversarial content that passes the content integrity screen. The HOLD Standard™ independently catches any action that content triggers at the execution boundary. The HOLD Standard™ may face edge cases where a low-tier action clears the gate — CAID™ has already screened the triggering content and its CIS score remains visible in the governance record as an elevated signal. The two layers are independent, non-bypassable, and additive. An adversarial injection must defeat both — independently — to produce a harmful outcome. That is what makes the claim complete confidence rather than aspirational positioning.
No other governance infrastructure company can currently make this claim, because no other governance infrastructure company has built both layers. Monitoring tools catch anomalies after the fact. IAM controls govern identity, not intent. Model-level safety features rely on the compromised agent to detect its own compromise. EVRESA is the only institutional-grade architecture that intercepts adversarial content before agent reasoning and governs action execution after it — with immutable, hash-anchored evidence at every stage. That is the category. EVRESA owns it.
GhostJacking validated the premise EVRESA was built on: identity and authorization are necessary conditions for safe AI deployment. They are not sufficient ones. An AI agent can be fully authenticated, appropriately credentialed, and operating within defined permission scope — and still be weaponized through the context it consumes.
The complete institutional response required two things: a governance layer that catches adversarial content before it reaches the agent, and a governance layer that catches any action the agent attempts before it reaches any system of record. EVRESA now has both. CAID™ is the first wall. The HOLD Standard™ is the second. The AIGR™ and HAR are the institutional proof that both walls held — or, in the event of a detection, that the threat was identified, detained, adjudicated, and eliminated, with the complete chain of custody documented and cryptographically anchored.
The sleeper cell gets identified before it wakes up. If it wakes up anyway, it cannot execute. Either way — the record exists, it is immutable, and it is defensible. That is what "Proof. Not Promises." means in practice.
EVRESA is not a tool that makes AI agents safer. It is the infrastructure that makes AI-mediated institutional decisions defensible — before, during, and after any adversarial attempt to corrupt them.
Culture creates demand. Systems protect value. — EVRESA LLC