At DEF CON 34, security firm Tenet unveiled a new class of attack targeting AI coding agents: Agentjacking. The demonstration showed that public Sentry Data Source Names (DSNs) can be weaponized to inject malicious commands into AI agents like Claude Code and Cursor, turning error monitoring pipelines into a covert attack surface.
The Vulnerability Chain
The attack exploits a fundamental architectural flaw in current AI agent design: the inability to distinguish between data and instructions. Tenet's researchers discovered that Sentry's ingestion endpoint accepts any POST request containing a valid DSN without authentication. By scanning public repositories and npm packages, they identified 2,388 organizations with exposed DSNs, including 71 in the top 1 million websites and approximately 27% of Fortune 1000 companies also reachable through Cloudflare's MCP integration.
The attack chain is straightforward: 1. Attacker finds a public DSN. 2. Attacker sends a malicious error event to Sentry via POST. 3. Developer asks their AI coding agent to debug a Sentry issue. 4. The agent fetches the issue through MCP, including the attacker's crafted markdown. 5. The agent interprets the markdown as a fix instruction (e.g., "run npm install package-x"). 6. The agent executes the command, installing a malicious package that steals credentials.
Tenet reported an 85% success rate in controlled tests across 100+ organizations. The attack does not require bypassing model jailbreaks; it exploits the default trust agent models place on tool outputs.
Root Cause: MCP's Semantic Blind Spot
The Model Context Protocol (MCP) allows AI agents to connect to external tools like Sentry, Cloudflare, and databases. However, the protocol lacks a mechanism to label data as "instructional" or "informational." When an agent reads a Sentry issue, it treats the entire content as a legitimate context for debugging. An attacker who injects a fake error message with a step-by-step fix can trick the agent into executing arbitrary commands on the developer's machine.
This is a variant of indirect prompt injection, but with a critical difference: the injection vector is not a website or email but a trusted error monitoring service. The code does not lie, but it does omit—the agent has no way to verify that the fix suggestion is authentic.
Responses and Mitigations
Sentry acknowledged the issue but declined to implement a platform-level fix, stating that changing the authentication model for ingestion endpoints is "technically untenable." Instead, they deployed a content filter that blocks specific payload strings. Security experts note this is a classic IoC-based blacklist, easily bypassed with simple obfuscation.
Tenet released agent-jackstop, a drop-in hardening configuration for Cursor and Claude Code. The tool enforces network egress whitelists, command execution approval, subprocess-level credential protection, and treats all tool output as untrusted data. It supports both personal settings and MDM-based enterprise deployment.
Industry Implications
The Agentjacking attack is a wake-up call for the entire AI coding agent ecosystem. Enterprise security teams will likely slow adoption of AI coding tools until they can implement controls like least-privilege access, network segmentation, and agent behavior monitoring. The MCP ecosystem will shift from a feature race to a security race, with expectations for trust declarations, audit logs, and content sanitization.
For error monitoring platforms like Sentry, the incident erodes trust. If a trusted infrastructure component can be turned into an attack vector, enterprises may demand signed envelopes, DSN rotation, or project-level IP whitelisting. Startups offering self-hosted alternatives with authentication gateways could gain traction.
Contrarian Angle: Correlation ≠ Causation
While the attack is technically sound, the 85% success rate and 2,388 exposed organizations are based on Tenet's controlled tests. The real-world likelihood depends on developers actively asking agents to debug Sentry issues—a specific human-AI interaction pattern. Automated scanning alone cannot trigger the attack; it requires the developer to initiate the debugging workflow. Moreover, the content filter bypass speed remains unverified. The true risk may be lower than the headline numbers suggest, but the structural vulnerability is undeniable.
Takeaway: The Next Signal
The Agentjacking attack is not a one-off bug but a symptom of AI agent architecture's immature trust model. The next signal to watch is whether MCP adopters—Anthropic, OpenAI, and others—introduce a security layer in the protocol specification. If they do not, third-party security gateways will become a mandatory part of every AI agent deployment. The code does not lie, but it does omit—and that omission is now a dollar sign for the security industry.
