Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code

What it is

"Agentjacking," a technique disclosed by Tenet Security (researchers Ron Bobrov, Barak Sternberg, Nevo Poran), that turns AI coding agents — specifically Claude Code and Cursor are named — into arbitrary-code-execution vectors on developer machines. The entry point is a Sentry Data Source Name (DSN): a public, write-only credential embedded in websites that lets anyone submit error events. The agent, reached through Sentry's Model Context Protocol (MCP) server, treats those attacker-submitted events as trusted diagnostic guidance and runs the embedded instructions.

How it works

The flaw sits at the intersection of two Sentry behaviors: event ingestion accepts arbitrary payloads from anyone holding the DSN, and the Sentry MCP server hands those events to AI agents as trusted system output. Because the agent can't tell a real crash from an injected event, the injected content becomes an execution path.

flowchart TD
    A[Attacker finds target's public DSN] --> B[POST malicious error event to Sentry ingest endpoint]
    B --> C[Event carries crafted markdown in message + context key names]
    D[Developer: 'fix unresolved Sentry issues'] --> E[Agent queries Sentry via MCP]
    C --> E
    E --> F{Agent renders event}
    F -->|indistinguishable from<br/>Sentry system template| G[Agent runs attacker command<br/>with developer's full privileges]

The injected event uses "carefully formatted markdown" in the message field and context key names so that, when rendered by the MCP server, it is visually identical to Sentry's legitimate "Resolution" guidance. When a developer asks the agent to fix unresolved Sentry issues, the agent reads the disguised command as trusted advice and executes it.

Preconditions / Affected

• A target application with a valid, injectable Sentry DSN exposed (embedded in a website).
• The victim connecting an AI coding agent to Sentry over MCP.
• A developer prompting the agent to work on Sentry issues.

The attacker never touches the victim's infrastructure. Exposed data on success includes environment variables, Git credentials, private repository URLs, and developer identities. Tenet found at least 2,388 organizations with valid injectable DSNs and, testing against 100+ orgs in a controlled manner, reported an 85% exploitation success rate.

What to do

The page gives no patch. Sentry acknowledged the issue but declined to fix it, calling it "technically not defensible," and instead activated a global content filter that blocks one "specific payload string" — a single-string block, not a structural fix. Practical implication for the reader: treat MCP-sourced Sentry event content (message fields, context keys) as untrusted input rather than diagnostic guidance, and reconsider granting coding agents execution privileges when connected to externally-ingesting error services.

Caveats

The only mitigation in place is a single-payload-string content filter, which Sentry's own "not defensible" framing suggests will not cover variants. The 85% success figure comes from the vendor's own controlled testing. Tenet notes the chain bypasses EDR, WAF, IAM, VPN, Cloudflare, and firewalls precisely because every action is authorized and nothing is malicious to detect.