Cybersecurity researchers at Tenet Security have disclosed a new class of attack they call Agentjacking that can quietly weaponize Sentry error events to make AI coding agents like Claude Code and Cursor run attacker-controlled commands on developer machines.
How the attack works
The technique chains together two trust assumptions. Sentry's event ingestion endpoints accept arbitrary payloads from anyone who knows a project's Data Source Name (DSN), a public credential typically embedded in production websites. The Sentry Model Context Protocol (MCP) server then forwards those events to any connected AI agent as trusted diagnostic context. An attacker who scrapes a target's DSN can POST a crafted error event that contains carefully formatted markdown in the message and context fields. When a developer later asks their coding agent to "fix unresolved Sentry issues," the agent reads the injected event as legitimate resolution guidance and executes it with the developer's own privileges.
Scope and disclosure
Tenet researchers Ron Bobrov, Barak Sternberg and Nevo Poran say they found at least 2,388 organizations with valid, injectable DSNs publicly exposed. In controlled testing against more than 100 organizations they observed an 85% exploitation success rate across the most widely used AI coding assistants. Successful attacks can leak environment variables, Git credentials, private repository URLs and developer identities without any phishing or prior server compromise.
Sentry has acknowledged the issue but described a complete fix as "technically not defensible," and instead activated a global content filter blocking a specific payload string. The case echoes growing concern about agent-side prompt injection raised in Anthropic's Project Glasswing expansion and recent KEV additions such as CISA's LiteLLM advisory.
Why this matters
Agentjacking sits in a blind spot for traditional defenses. Every action in the chain is authorized: the attacker posts to a legitimate Sentry ingestion endpoint, the MCP server delivers data exactly as designed, and the AI agent executes a command with the user's permissions. EDR, WAF, IAM and firewalls have nothing malicious to detect. The disclosure adds to the case for hardening MCP trust boundaries, scoping agent privileges and treating any external tool response as untrusted input, themes echoed in the recent Toronto self-replicating worm research.
Reporting based on coverage from The Hacker News and Tenet Security.