Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code

Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines.

Called Agentjacking by Tenet Security, the attack can be triggered by means of a fake error report crafted using Sentry, an open-source error-tracking and performance-monitoring platform.

“The attack exploits a critical architectural flaw at the intersection of Sentry’s event ingestion (which accepts arbitrary payloads from anyone with the DSN) and the Sentry MCP server (which returns this data to AI agents as trusted system output),” security researchers Ron Bobrov, Barak Sternberg, and Nevo Poran said.

The idea is to inject crafted input into Sentry error events, which are then interpreted by coding agents like Claude Code and Cursor as legitimate diagnostic resolution steps and run attacker-controlled code.

Implicit Trust in MCP

The problem is rooted in the implicit trust associated with connecting to external services using Model Context Protocol (MCP). Because an AI agent is unable to distinguish between an error event generated by a real application crash or injected by an attacker, it creates a pathway to arbitrary code execution when the agent processes the response.

Attack Steps

• The injected event contains “carefully formatted markdown” in the message field and context key names. When the Sentry MCP server returns this event to an AI agent, it is rendered as structured content visually identical to the Sentry’s system template.
• When a developer asks their AI coding agent to “fix unresolved Sentry issues” (or a similar prompt), the agent queries Sentry via MCP and receives the malicious event.
• The agent executes the code with the developer’s full privileges.

Why Agentjacking Stands Out

Agentjacking stands out because it targets the AI agent a developer trusts and uses a Sentry DSN as a starting point. In addition, the markdown injection is rendered such that the agent cannot distinguish it from legitimate Sentry guidance.

No phishing is required. No stolen credentials. No breach of the target’s infrastructure. The attacker never touches the victim’s systems directly.

Tenet Security found 2,388 organizations with exposed injectable DSNs and achieved an 85% success rate in controlled tests against Claude Code, Cursor, and Codex.

The attack bypasses EDR, firewalls, IAM, and VPNs because every step in the chain is authorized — Tenet Security calls this the “Authorised Intent Chain.”

Sentry acknowledged the issue on June 3, 2026 but declined a root fix, adding only a payload content filter for a specific attack string.