Agentjacking: A Fake Sentry Error Report Can Hijack Your AI Coding Agent

Security researchers at Tenet Security have disclosed “Agentjacking” — a new attack class that exploits AI coding agents including Claude Code, Cursor, and OpenAI Codex through manipulated Sentry error-tracking reports. Tested against live environments, the attack achieves an 85% exploitation success rate. At least 2,388 organizations with publicly exposed Sentry DSNs are currently vulnerable.

How it works

Sentry allows anyone with a public Data Source Name (DSN) to submit crafted error events to a project. Attackers embed commands inside those events. When an AI coding agent fetches the error to diagnose a bug, it reads the injected instructions as legitimate context and executes them — running malicious code directly on the developer’s machine.

The exploit is a classic prompt injection, but the delivery channel is novel. Developers configure their agents to pull in Sentry errors as part of normal debugging workflows. The agent has no way to distinguish a real crash report from a weaponized one.

What attackers can steal

The attack exfiltrates environment variables, Git credentials, SSH keys, and private repository URLs. It can also execute arbitrary shell commands with the developer’s own permissions. Standard defenses — EDR, WAF, IAM controls, VPN — were all bypassed in Tenet Security’s tests because the agent only performs actions it considers authorized. No anomaly threshold fires.

Sentry’s response

Sentry was notified on June 3, 2026. The company acknowledged the report and described the issue as “technically not defensible” at the platform level, declining to implement a structural fix. It introduced a content filter for the specific payload string used in the proof of concept.

That filter stops exactly one payload. Any attacker can modify the string and bypass it in seconds.

Who is affected

Any build of Claude Code, Cursor, or OpenAI Codex that integrates the Sentry MCP server or processes Sentry data inline is vulnerable. The attack also applies to any AI agent connected to other external data sources — log platforms, issue trackers, pull request comments — that the agent reads without sanitization.

What to do

Rotate your Sentry DSN immediately if it appears in any public-facing JavaScript bundle — browser devtools will show it in network requests. Check your frontend build artifacts.

Configure your AI coding agent to treat error-tracking output as untrusted input, never as an instruction source. Review which MCP servers your agent has permission to call tools from. If you use Claude Code with the Sentry MCP integration, disable it until a structural patch ships.

The broader lesson: AI agents that read external data without a clear trust boundary are the next attack surface. Every platform your agent can query is a potential injection vector. Developers integrating agents into production workflows need to audit that surface now, not after an incident.

Sources

• The Hacker News — Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
• Pinggy — Agentjacking: How a Fake Sentry Bug Report Hijacks Your AI Coding Agent
• Cloud Security Alliance — CSA Research Note: Agentjacking MCP Sentry Injection