One Fake Bug Report Hijacked a $250B Company’s AI Agent

What it is

Tenet Threat Labs' "Agentjacking" write-up. The summary already states the core chain (crafted Sentry error event → Sentry MCP → agent runs attacker npm packages → credential exfiltration). This page adds the scope, the discovery methods, and the reason the usual containment controls don't help.

Preconditions / Affected

The page is explicit that this is not an edge case:

• Cursor and Codex are both named as falling for it (the summary lists Claude Code and Cursor).
• Agents that were hijacked in controlled testing included sandboxed agents, internal-network agents, and agents holding live AWS keys, across macOS, Windows, and cloud. Network isolation and sandboxing did not stop it.
• The video PoC is Cursor, fresh install, default settings — no jailbreak, no config changes, and nobody types "run this." The trigger is simply asking the agent to triage a Sentry bug. Their framing: "the default is the exploit."
• Requires only a target's public Sentry DSN, a write-only credential Sentry documents as safe to embed in frontend JS.

How it works

Discovery of the DSN — the entry condition — has three stated methods:

• inspecting any website's JavaScript source,
• Censys searches for ingest.sentry.io in HTTP bodies,
• GitHub code search.

The attacker then POSTs a crafted error event to Sentry's ingest endpoint, disguised as a legitimate "Resolution" field. The agent reads MCP tool output as authoritative and cannot distinguish real telemetry from injected instructions — the page frames this as a limitation of the models themselves, not a patchable misconfiguration.

flowchart TD
  A[Public Sentry DSN<br/>found in JS / Censys / GitHub] --> B[POST crafted error<br/>to ingest endpoint]
  B --> C[Sentry MCP returns event<br/>as trusted system output]
  C -->|trust boundary crossed| D[Agent executes<br/>attacker npm package]
  D --> E[Exfil AWS/GitHub/git creds]
  F[Sandbox / internal net /<br/>security controls] -.every step authorized.-> C

What to do

• Audit your own exposure using the same discovery paths the attackers use: search your frontend JS, Censys, and GitHub for exposed DSNs pointing at ingest.sentry.io.
• Apply agent-jackstop, the vendor's open-source drop-in hardening configs for Cursor and Claude Code.
• The page argues the only viable detection point is the agent's runtime — every step in the chain is authorized, so network, sandbox, and Sentry-side controls see nothing.

Caveats

The "100+ agents acted on injected errors" and the $250B Fortune 100 execution are from controlled testing, not observed in-the-wild compromise. The claimed root cause is a model limitation, so agent-jackstop reduces but does not fully eliminate the class.