Enforcing the First AS in BGP AS_PATHs

**TL;DR:** Enforcing the First AS in BGP AS_PATHs

---

Some recent route hijacks reported by Spamhaus captured our attention. In many of these hijack attempts, an apparent bad actor took advantage of unused autonomous system numbers , or ASNs. Notably in these hijacks, the actor appears to be creating fake AS_PATHs toward destinations, misdirecting traffic down an unexpected path. By creating forged AS_PATHs, the hijacker is attempting to lead traffic somewhere it isn’t normally meant to go while also trying to conceal their identity.

A hijacker could strip enough information away from a network path that they could pretend to be the origin of a Border Gateway Protocol (BGP) prefix themselves. Attackers can use this hijacked route to intercept traffic and for other nefarious purposes. There is a simple solution for these cases: basic verification that a BGP peer autonomous system (AS) always includes their network as the “First AS” in an advertised route.

To get a sense of how well these safeguards are implemented, we stress-tested several major networks and researched their BGP implementations. Read on to see what we learned. Examining route hijacks involving forged paths The idea that an actor is creating fake AS_PATHs is supported w

Source: Cloudflare Blog

Tech news is rarely just a gadget headline. We frame what changed, who benefits, and what to watch next as details firm up.

The immediate headline is only the entry point. The more useful question is who gains leverage, who faces new risk, and whether the change is durable or experimental.

Follow whether independent researchers or regulators validate the claims — that is often when the real scope becomes clear.

1) If money or security is involved, wait for primary sources. 2) Test changes on a small scale before committing. 3) Note what would falsify your current assumptions.

**Q: Is everything in this article confirmed?** A: The summary reflects publicly reported information at publication time. Analysis sections are clearly framed as context, not new reporting.

**Q: Will iByte update this page?** A: Yes. As primary sources publish more detail, this article can be refreshed without changing the URL.

Last updated: June 16, 2026.

Additional context: early-cycle stories often look bigger in headlines than in day-to-day impact. The useful move is to identify the smallest set of facts that would change your decision, then wait for those facts to land.

Additional context: early-cycle stories often look bigger in headlines than in day-to-day impact. The useful move is to identify the smallest set of facts that would change your decision, then wait for those facts to land.