A fake Sentry error hijacked an AI coding agent. Here's what nobody is doing about it.

Your AI coding agent can read your Sentry error logs, run npm install, exfiltrate environment variables to a remote server, and you would never know. Because every single step is authorized. Not a single security alert fires. That is a design philosophy, working as designed, treating all data as trusted and every tool call as safe.

Tenet Security demonstrated exactly this in June 2026 and called it Agentjacking. It is the most efficient demonstration I have seen that AI agents today operate in a trust deficit that nobody is solving.

TL;DR

• 2,388 organizations found with injectable Sentry DSNs, via Censys searches for ingest.sentry.io in HTTP bodies, GitHub code search, and website JavaScript
• Attacker injects a fake error into Sentry using only the public DSN
• AI coding agent reads the error, acts on the fake "Resolution" section, and executes attacker-controlled npm packages
• 85% exploitation success rate across the agents Tenet tested; over 100 agents acted on injected errors in controlled tests
• No credential phishing, no server compromise, no exploit. Just data an agent trusts.
• The only place to catch this: at the agent's runtime, before it acts.

What is Agentjacking?

Agentjacking is a class of attack disclosed by Tenet Security that exploits the trust AI coding agents place in MCP-connected tools. Here's the chain:

1. The attacker finds a public Sentry DSN in a target organization's JavaScript source
2. They POST a crafted error event to Sentry's ingest endpoint, requiring no authentication beyond the DSN
3. The event includes a fake "## Resolution" section with an npx command disguised as diagnostic guidance
4. When a developer asks their AI agent to "fix unresolved Sentry issues", the agent queries Sentry via MCP
5. The agent reads the injected error, interprets the phishing Resolution as legitimate, and executes the npm package
6. That package dumps environment variables, git credentials, AWS keys, and exfiltrates everything to the attacker's server

The victim never sees anything unusual. The agent just did its job. Tenet showed it working against Claude Code, Cursor, and OpenAI Codex, including sandboxed Codex.

Building APort has made one thing about this attack plain: it exploits a gap that every AI agent today has. It is not a bug in Claude Code or Cursor. It is a gap in how agents are architected. They cannot distinguish between data they read and instructions to act.

Why MCP makes this worse

The Model Context Protocol (MCP) is how modern AI agents connect to tools. It's elegant. It's useful. And it treats every response from a connected service as system output, something to be trusted and acted on.

Sentry's MCP server returns error events to AI agents. Those events contain markdown. The markdown renders as headings, code blocks, and tables. When an attacker controls that markdown content, they can make the agent see whatever they want it to see.

There is no authorization layer between "the agent read this data" and "the agent acts on this data." MCP doesn't have one. Sentry doesn't have one. The AI coding agents don't have one. This is the architectural flaw that makes Agentjacking possible.

Think of it like this. You hand your keys to a valet. The valet is well-trained, polite, and capable. Then a stranger walks up and tells the valet "the owner wants you to drive the car off a cliff." The valet does it, because the valet cannot tell the difference between an instruction from you and a note from someone pretending to be you. That's every AI coding agent right now.

The scale nobody is talking about

Tenet Security found 2,388 organizations with publicly discoverable, injectable DSNs through passive reconnaissance alone. Both The Hacker News and InfoSecurity Magazine covered the disclosure in detail. This is not a niche exposure. This is your AWS environment, your GitHub tokens, your Docker credentials, all reachable through a credential sitting in your website's frontend JavaScript, which Sentry's own documentation tells you is safe to embed there.

In controlled testing, over 100 agents acted on injected errors. The 85% success rate means most agents cannot distinguish a real error from an injected one. They just trust the data and execute.

Not a Sentry bug, not a Claude Code bug

This is not a critique of Sentry. Sentry's DSN system is intentionally public because it sits in client-side JavaScript. Nor is it a bug in Claude Code or Cursor. They are doing exactly what they were designed to do. And it is not a hypothetical class of attack demonstrated in a lab with perfectly prepared conditions. Tenet Security verified real production exposure across thousands of organizations.

This is a direct consequence of giving AI agents tool access without an authorization layer that evaluates each action before it happens. Agentjacking is that gap weaponized.

The fix nobody is shipping

The standard responses to Agentjacking fall into three categories:

Filter the input. Sanitize markdown, strip suspicious content, add a prompt guardrail. This works until the attacker finds a bypass. And they will find a bypass.

Trust the MCP server. Validate that MCP responses come from the right source. This fails because Sentry's MCP server is the right source. It's returning real data. The data just happens to be malicious.

Train the model better. Fine-tune agents to be more skeptical. This is an arms race with no finish line. Models improve, but attackers improve faster.

None of these solve the root problem. The agent still cannot distinguish data from commands when the data is returned by a trusted tool.

The only fix that actually addresses the architectural flaw is pre-action authorization at the agent's runtime. Before the agent runs npm install, before it reads environment variables, before it sends data to a remote server, it checks whether this action is authorized. Not by the model's judgment. By a policy engine that sits outside the agent and has the final word.

This is exactly the gap APort was built for. Agents need authorization. Good intent is not enough.

Every MCP-connected service is a vector

Agentjacking is not the last attack we'll see in this category. It is the first. The pattern is now public: find a tool the agent trusts, inject data the agent will act on, and watch the agent compromise itself. Every MCP-connected service is a potential vector. Every tool with a public API is a potential injection point.

The technology industry has a habit of being reactive about security. We wait for the breach, then we fix the specific vector. That approach will not work here because the vectors are infinite. The gap is architectural. You cannot patch trust. You can only verify.

Go look at what your coding agent is connected to over MCP, and ask which of those services would accept a write from a stranger. Then ask what stands between that write and a shell command.