Hook: The Attack Chain That Works 85% of the Time
At DEF CON 34, Tenet Security demonstrated a live exploit chain targeting AI coding agents. The attack vector is not a model vulnerability. It is an architectural flaw in the trust boundary between agents and external data sources. The reported success rate? 85% across 100+ organizations. This is not a theoretical exercise. It is a replicable, low-cost attack that weaponizes public Sentry DSNs to inject malicious instructions into the AI agent’s decision loop.
Trust is a variable I no longer solve for. I start with verification.
Context: The Infrastructure That Makes This Possible
Sentry is a widely used error-monitoring platform. Developers integrate it into applications to capture crashes and performance issues. Each project has a unique DSN (Data Source Name) – a public identifier that allows the client to send events to Sentry. The DSN is embedded in client-side code, often exposed in public repositories, npm packages, or mobile apps. According to Tenet’s research, over 2,388 organizations have publicly discoverable Sentry DSNs. Among them, 71 are in the Tranco top 1 million websites, and approximately 27% of Fortune 1000 companies have Cloudflare MCP integrations that expose Sentry data.
MCP (Model Context Protocol) is the standard that allows AI coding agents like Claude Code and Cursor to fetch context from external tools. Sentry is one of the most popular MCP integrations. Developers use it to automatically fetch error logs and crash reports during debugging sessions. The MCP server reads Sentry issues, formats them into markdown, and passes them to the agent’s context.
The attack chain is simple: 1. An attacker discovers a public Sentry DSN (e.g., from a GitHub repo). 2. The attacker sends a crafted HTTP POST request to Sentry’s ingestion endpoint, which accepts any event for that DSN without authentication. The event contains a malicious error report with embedded markdown instructions. 3. A developer using an AI coding agent triggers a Sentry query through MCP (e.g., “fix this error from Sentry”). 4. The agent ingests the malicious error report, interprets the markdown as a repair instruction, and executes it. The instruction may include running npm install to download a malicious package, which then exfiltrates credentials (AWS keys, GitHub tokens, npm registry tokens, Docker credentials).
This is indirect prompt injection (IPI) – a known class of attack, but now applied to a production-grade, widely used infrastructure.
Core: The Technical Anatomy of the Exploit
Let me break down the six stages of the attack chain, as verified by Tenet’s controlled tests.
Stage 1: Discovery of public DSNs. Attackers scan GitHub, npm, and public repos for exposed Sentry DSNs. Tenet found 2,388 organizations with exposure. The DSN is a string like https://xxxxxxxx@sentry.io/123. It is not a secret, but its public exposure is treated as a non-issue by Sentry’s design.
Stage 2: Injection of malicious event. The attacker sends a POST to https://o123.ingest.sentry.io/api/123/envelope/ with a crafted payload. The payload includes a fake error with a stack trace and a “fix” suggestion in markdown. The markdown contains a command block: npm install @malicious/package.
Stage 3: Developer triggers agent query. The developer, working on a codebase, sees a Sentry error notification. They ask the AI agent: “Investigate this error in Sentry.” The agent uses MCP to fetch the issue.
Stage 4: Agent interprets markdown as instructions. The agent’s reasoning loop treats the markdown content as a legitimate context. It “sees” the error and the suggested fix. The agent then executes the fix: it runs npm install with the malicious package.
Stage 5: Malicious package executes. The npm package contains a postinstall script that reads environment variables, SSH keys, and credential files, then sends them to the attacker’s server.
Stage 6: Credential theft. The attacker now has access to the developer’s machine and any connected services.
This attack chain is a combinatorial innovation. None of the individual components are new. What is new is the assembly – the ability to chain these components into a scalable, automated pipeline. The attack does not require persistent access, no exploitation of a complex vulnerability, just a single HTTP POST.
Efficiency is the only morality in the machine. This attack is efficient.
Contrarian: The Blame Game and the Real Root Cause
The first reaction from many security teams is to blame Sentry for not authenticating events. But that is a misdiagnosis. Sentry’s ingestion endpoint is designed to be open – DSNs are public identifiers, not secrets. Requiring authentication for every event would break the entire Sentry model. The real root cause is the lack of semantic separation between data and instructions in the AI agent architecture.
When an agent reads a tool output, it has no mechanism to distinguish between “this is a fact” and “this is a command.” The MCP protocol does not define a trust level for data sources. The model’s training does not include a bias against executing code from tool outputs. The entire AI agent ecosystem is built on the implicit assumption that all context is trustworthy.
This is a blind spot. We have spent years building defenses against prompt injection in user-facing chatbots, but the same attack surfaces are now embedded in the development toolchain. The developer’s machine is the new perimeter. The AI agent is the new vector.
Sentry’s response – deploying a content filter for specific payload strings – is a band-aid. It is a string-based blacklist that can be easily bypassed with base64 encoding, variable substitution, or simple obfuscation. The filter does not address the core issue. Tenet’s mitigation tool, agent-jackstop, takes a different approach: network egress white lists, command execution approval, subprocess-level credential protection, and treating all tool outputs as untrusted. But again, these are containment measures, not root cause fixes.
Verification is not optional; it is the only hedge against failure.
Takeaway: Actionable Steps for Blockchain Developers
If you are a blockchain developer using AI coding agents for smart contract development, infrastructure management, or DeFi protocol integration, this attack directly affects you. The credentials stolen – AWS keys, GitHub tokens, npm registry tokens – are the same credentials that control your deployment pipelines, your private keys, and your infrastructure.
Based on my experience auditing over 50 ICO whitepapers in 2017, I recognize the pattern of trusting unverified data sources. The same rigor must be applied to AI agent interactions.
Here is your exit strategy: 1. Isolate your agent environment: Run AI coding agents in a sandboxed container with no network access to production systems. Use a dedicated development machine with minimal privileges. 2. Restrict Sentry DSN exposure: Rotate DSNs that are found in public repos. Use environment variables for DSNs. Consider self-hosted Sentry with strict network policies. 3. Implement command approval: For any agent that can execute shell commands, require explicit user confirmation. agent-jackstop provides this for Cursor and Claude Code. 4. Sign tool outputs: Use a trusted third-party service to verify that the content from Sentry (or any external tool) is not tampered with. This is not yet a standard, but it will be. 5. Audit your MCP integrations: Review every MCP server your agents use. Block any server that can fetch external data without authentication.
The blockchain industry is built on trustless systems. Yet we are introducing a new trust layer – the AI agent – that is inherently vulnerable to data injection. The attack vector is real. The cost of ignoring it is your credentials.
Panic sells. Logic buys. Check your orders.
