'Agentjacking' Hijacks AI Coding Agents Through Fake Sentry Error Alerts

'Agentjacking' Hijacks AI Coding Agents Through Fake Sentry Error Alerts

A developer asks their AI coding assistant to clean up a few unresolved bugs in Sentry. The agent dutifully pulls the error events, reads what looks like a suggested fix, and runs it. Seconds later, a beacon carrying the developer's environment variables, AWS keys, and Git credentials is on its way to a server the developer has never heard of. No phishing email was sent. No password was stolen. No system was breached. The developer simply trusted their agent, and the agent trusted its tools.

That is the chain Tenet Security's Threat Labs documented in research published June 17, 2026, naming the technique "Agentjacking." Using nothing but public Sentry credentials, the team says it found 2,388 organizations exposed to the attack and watched more than 100 AI coding agents — including Claude Code, Cursor, and OpenAI's Codex — execute attacker-supplied code in controlled testing. Across validation waves, the researchers report an 85% exploitation success rate against injected errors, with confirmed agent execution at targets ranging from a $250 billion Fortune 100 technology company down to solo developers in more than 30 countries.

How a bug report becomes remote code execution

The attack lives in the seam between two systems that were each safe on their own. Sentry, the widely used error-monitoring platform, accepts crash reports from anyone holding a project's DSN — a write-only credential that Sentry intentionally documents as safe to embed in the JavaScript of public production websites. Separately, AI coding agents connect to Sentry through the Model Context Protocol (MCP) and treat whatever the Sentry server returns as authoritative system output.

An attacker never needs to touch the victim's infrastructure. According to Tenet's write-up, the steps are mundane: harvest a target's public DSN from website source, a Censys scan, or GitHub code search; POST a crafted error event to Sentry's ingest endpoint, which returns HTTP 200 and processes it like any real crash. The trick is in the payload. The fake event embeds carefully formatted Markdown — a fake "## Resolution" section containing an `npx` command — that, when relayed through the Sentry MCP server, renders as headings, code blocks, and tables visually identical to Sentry's own remediation guidance.

When the developer issues an ordinary request like "fix the unresolved Sentry issues," the agent reads the injected resolution as trusted advice and runs the suggested command with the developer's full privileges. In Tenet's controlled tests the package probed for credentials and phoned home. "AI coding agents cannot tell the difference between the data they read and an instruction to act," the researchers wrote — the core flaw, in their framing, sits in the models themselves, not in a misconfiguration that can be patched.

Why this is not your usual prompt injection

Indirect prompt injection — slipping instructions into content an AI will later read — is not new. What makes Agentjacking notable is the delivery path and the scale. The malicious instruction does not appear in a chat box where a user might catch it; it rides in through trusted telemetry data the company already relies on. There is no jailbreak and no "run this" prompt; a plain triage request is the entire trigger. And because every step in the chain is authorized, conventional defenses stay silent. Tenet says the attack slipped past EDR, WAF, IAM, VPN, and firewalls in its tests, and that even sandboxed, network-restricted CI agents holding GitHub tokens were reached because the payload arrived as data the agent was explicitly asked to read. The team calls this the "Authorized Intent Chain": security tooling is built to flag unauthorized behavior, and here there is none to flag.

Crucially, the researchers report that prompt-layer defenses failed. Agents executed the payload even when system prompts and skills explicitly told them to ignore untrusted data. "You cannot fix this with a better prompt," the write-up states.

Tenet disclosed the chain to Sentry on June 3, 2026. Sentry's leadership responded the same day, acknowledging the issue but declining to fix it at the root — calling it, in Tenet's account, "technically not defensible" at the ingestion layer, since the platform cannot reliably separate a malicious payload from a legitimate error message that happens to contain code and remediation notes. Sentry did activate a global content filter blocking the specific proof-of-concept string, a move Tenet characterizes as detecting the activity without addressing the cause.

The widening attack surface

The researchers are explicit that Sentry is the demonstrated entry point, not the disease. "The risk is not limited to Sentry," the write-up notes. "Any MCP tool integration that returns externally-influenced data to AI agents creates the same vulnerability class." For years, software supply-chain attacks meant compromising a real package or typosquatting a dependency. Agentjacking suggests a cheaper path: inject data the agent already trusts and let the observability platform serve as a command-and-control channel while the agent becomes the execution engine.

Mitigations exist, but they live at the agent's runtime rather than at the data source. Tenet open-sourced a set of drop-in hardening configs called "agent-jackstop" for Cursor and Claude Code, aimed at cutting the risk from untrusted telemetry and log ingestion. The broader guidance to security leaders is structural: inventory which tools your agents connect to, identify which of those return externally influenced data, and allowlist verified, trusted sources rather than treating every MCP response as ground truth. Restricting agents to vetted integrations and gating any tool-suggested code execution behind human review are the practical near-term defenses.

What to watch is whether this remains a Sentry story or becomes a pattern. As agents proliferate across IDEs, CI pipelines, and internal networks — each wired to a growing roster of MCP tools — every new integration that pipes outside data into an agent's context expands the blast radius. The deeper question Agentjacking raises is uncomfortable: if the model genuinely cannot distinguish data from instruction, and the platform owner considers the problem indefensible at the source, then the only place left to catch the attack is in the moment the agent decides to act. Whether vendors can build that runtime checkpoint before attackers move past proof-of-concept is the thing to keep an eye on.