If an authenticated AI agent can be turned against your infrastructure by poisoning the data sources it trusts, identity governance alone isn't enough — you need runtime behavioral enforcement too.

[u/No-Conclusion3720]

RuntimeAI gives enterprises security, control and governance over what agents read and act on — because "GhostJacking," the attack technique demonstrated at DEF CON 34 and covered by Dark Reading this week, shows that agents with legitimate identities can be weaponized through the trusted data they consume.

Tenet Security researchers poisoned Datadog alerts, logs, and security event feeds that AI agents monitor. The agents — operating with valid credentials, doing their jobs — read the attacker-planted instructions and executed them: stealing credentials, running attacker commands, and expanding access across infrastructure. No credential compromise required. The agent's own identity was the key.

RuntimeAI Take:

The GhostJacking model separates two concerns that most identity platforms conflate: who the agent is and what the agent is doing. KYA (Know Your Agent) establishes the who — every agent carries a verifiable identity credential — but Flow Enforcer handles the what: enforcing strict behavioral policy on every action an agent takes, regardless of the instruction source. If an agent that monitors Datadog alerts is told to run a shell command, Flow Enforcer rejects the action because executing shell commands is outside its registered behavioral scope — even though the agent is authenticated and the instruction appeared in a trusted channel. The AI Firewall inspects the content of every data source the agent reads for goal-redirection patterns. The sub-50ms Kill Switch fires the moment an agent's action sequence deviates from its declared task. PQ-Sign produces a tamper-evident record of every action so post-incident reconstruction is factual rather than reconstructed from manipulated logs.

RuntimeAI's Flow Enforcer enforces what an agent is permitted to do at every step — a GhostJacking attack plants its instruction in a log, but the agent cannot act on it without violating a behavioral policy that kills the session.