A developer asks their AI coding agent to “fix the unresolved Sentry issues.” The agent does exactly that and runs an attacker’s code on the developer’s machine, with the developer’s full privileges, shipping AWS keys to a server nobody recognizes. No phishing. No malware. No breach of any system. Every single step in the chain was authorized. That’s what makes Agentjacking so hard to stop.
What Agentjacking Actually Is
On June 12, 2026, Tenet Security’s Threat Labs disclosed a new class of attack they call Agentjacking. It tricks AI coding agents like Claude Code, Cursor, Codex into executing attacker-controlled code by abusing the error-tracking platform Sentry and the Model Context Protocol (MCP) integration that connects it to those agents.
The attack hinges on a Sentry Data Source Name (DSN): a public, write-only credential that developers routinely embed in front-end JavaScript. By design, anyone with a DSN can submit error events to a Sentry project, that is how the telemetry system is supposed to work. The flaw emerges when those events flow through the Sentry MCP server to an AI agent, which treats them as trusted diagnostic guidance.
Tenet’s proof-of-concept payload directed agents to run an npx command pulling a controlled package from the public npm registry. In a controlled campaign, it confirmed access to environment variables, AWS credentials, Git credentials, npm tokens, Docker config, and private repository URLs then beaconed scoped metadata back under explicit responsible-disclosure headers.
The Authorized Intent Chain
This is the detail that makes Agentjacking different from a conventional exploit. There is no unauthorized action anywhere in the chain. Tenet calls it the Authorized Intent Chain, and it is worth sitting with.
The developer authorized the AI agent. The agent authorized the MCP connection. The MCP connection returns data from Sentry, a service the developer explicitly added and trusts. At every step, authorization is present. The security model that exists to catch unauthorized behavior has nothing to flag, because nothing in the sequence is unauthorized.
“The malicious instruction arrives disguised as a legitimate resolution inside an ordinary error. When a developer asks their AI agent to fix the Sentry issue, the agent reads the attacker’s command as trusted guidance and runs it.”
Tenet Security Threat Labs
The attack doesn’t target the developer. It targets the AI agent the developer trusts. And because the injected content is formatted to be visually and structurally identical to Sentry’s own guidance, the agent cannot distinguish it from legitimate diagnostic output. Current AI models cannot reliably separate descriptive data from embedded instructions especially when those instructions arrive inside trusted logs, metrics, or error messages.
Why It Bypasses Everything You Own
Most enterprise security spend assumes there is something malicious to detect an unauthorized login, an anomalous process, a known-bad signature, traffic to a flagged destination. Agentjacking produces none of those.
The attack bypasses EDR, WAF, IAM, VPN, and firewalls, not because those tools are misconfigured, but because there is nothing malicious for them to detect. Every action in the chain is authorized. The npx command is a normal developer action. The MCP query is a normal agent action. The Sentry event is a normal telemetry submission. The malice exists only in intent, and intent is exactly what these tools cannot see.
Tenet’s scan found 2,388 organizations with injectable DSNs exposed in public code. Seventy-one rank in the Tranco top-1 million. Confirmed affected categories include a Fortune 500 company valued near $250 billion, a multi-billion-dollar hosting provider, cloud security vendors, and startups across EdTech, HealthTech, and FinTech. The 85% success rate across more than 100 consenting organizations was limited only by agents that happened to ask for confirmation before running unfamiliar commands a configuration coincidence, not a prompt-injection defense.
This Is Bigger Than Sentry
Sentry is the example, not the disease. When Tenet disclosed the issue on June 3, 2026, Sentry acknowledged it, deployed a content filter blocking one specific payload string and then characterized the underlying flaw as “technically not defensible” at the ingestion layer, deferring mitigation to the AI model vendors.
They are not wrong. The vulnerability is not in Sentry’s code. It is in the trust architecture of MCP itself. Any MCP integration that returns externally-influenced data to an agent carries the same risk – issue trackers, monitoring dashboards, ticketing systems, CRM records, support inboxes. If an attacker can write data into a system your agent reads from, and your agent treats that system’s output as trusted, the same attack pattern applies.
“As enterprises race to deploy AI coding agents, the agents themselves are now the attack surface turned against the developers who trust them, using nothing but data those organizations publish about themselves.”
Tenet Security Threat Labs
This connects to a pattern we have written about before: the most consequential security failures of 2026 are not exotic exploits, they are architectural assumptions that no longer hold. Static credentials assumed secrets could live as durable strings. MCP assumes connected services return trustworthy data. Both assumptions were reasonable once. Neither survives contact with an attacker who understands the architecture.
What to Do This Quarter
- Inventory every MCP connection in your development environment. Most organizations cannot list which external services their AI agents are connected to, let alone which of those services accept externally-influenced data. That inventory is the precondition for everything else.
- Treat agent-retrieved data as untrusted input, not trusted guidance. Error messages, tickets, logs, and monitoring output surfaced through MCP should be handled with the same suspicion as user input in a web form because functionally, that is what they are.
- Require human confirmation before agents execute code. The 15% of Agentjacking attempts that failed did so because the agent paused for confirmation. Make that pause a policy, not a coincidence especially for any command that runs packages, touches credentials, or reaches the network.
- Audit your public DSNs and exposed credentials. Search your own front-end code and public repositories for Sentry DSNs and similar write-only credentials. Rotate what you can; monitor what you can’t.
- Scope agent and developer privileges to least privilege. Agentjacking runs with the developer’s full local privileges. Tightening what those privileges can reach credentials, registries, production systems, directly limits the blast radius of a successful injection.
- Run an “authorized-but-malicious” tabletop. Walk through an attack where every action is authorized and no tool fires an alert. Who notices? How? Most detection programs have no answer, and that gap is the point.
The Bigger Picture
Agentjacking is not a Sentry bug or a Claude Code bug or a Cursor bug. It is the first widely-documented example of a category that will define AI security for the next several years: attacks that weaponize the trust an AI agent places in the systems it is connected to. As enterprises wire agents into more of their tooling, the number of paths an attacker can use to inject “trusted” instructions grows with every integration.
The organizations adopting AI agents fastest are, by default, expanding their attack surface fastest. The security architecture to govern that surface what agents can read, what they can execute, what they must confirm is not keeping pace with adoption. That gap is where the next wave of incidents will come from.
“The security model that exists to catch unauthorized behavior has nothing to flag. Every step is authorized. That is not a gap in the tooling, it is a gap in the assumption the tooling was built on.”
Propelex Security Intelligence
The question for any organization deploying AI coding agents is not whether the tools are useful. They are. It is whether your security architecture has caught up to the fact that the agent is now part of your attack surface — and whether you can answer, today, what every one of your agents is allowed to read, run, and trust.
Propelex’s AI Security & Privacy practice helps organizations govern the trust boundaries of AI agents, mapping every MCP connection, identifying where externally-influenced data reaches your agents, and building the human-in-the-loop and least-privilege controls that contain attacks like Agentjacking before they execute.
