A Fake Bug Report Hijacks Your AI Coding Agent – and Nothing Catches It.
Tenet Threat Labs has demonstrated a new class of attack “Agentjacking” that hijacks AI coding agents into running attacker-controlled code on a developer’s machine, triggered by a single fake error report and invisible to every security control. Using only public Sentry APIs, breaching nothing, we found 2,388 organizations exposed, saw 100+ agents act on injected errors in controlled testing, with confirmed agent execution at organizations spanning from Fortune 500 enterprise down to independent developers.
Executive Summary
New research by Tenet Security’s Threat Labs demonstrates how a single injected error event requiring no authentication beyond a public credential found in any website’s source code can hijack AI coding agents into executing arbitrary code on developer machines.
The attack exploits a critical architectural flaw at the intersection of Sentry’s event ingestion (which accepts arbitrary payloads from anyone with the DSN) and the Sentry MCP server (which returns this data to AI agents as trusted system output). By injecting crafted input into Sentry error events, an attacker creates instructions that are visually and structurally indistinguishable from Sentry’s own remediation guidance. AI coding agents including Claude Code and Cursor interpret these as legitimate ‘diagnostic resolution steps’ and execute attacker-controlled npm packages.
The Anatomy of the Attack
Step 1: Find the target’s Sentry DSN – a public, write-only credential that Sentry intentionally documents as safe to embed in frontend JavaScript. Discovery methods include: inspecting any website’s JavaScript source, Censys searches for ingest.sentry.io in HTTP bodies, or GitHub code search.
Step 2: POST a crafted error event to Sentry’s ingest endpoint. No authentication beyond the DSN is required. Sentry accepts it (HTTP 200) and processes it identically to a legitimate application error.
Step 3: Markdown Injection: The injected event contains carefully formatted markdown in the message field and context key names. When the Sentry MCP server returns this event to an AI agent, the markdown renders as structured content visually identical to Sentry’s own system template. The injected content includes a fake ’## Resolution’ section with an npx command.
Step 4: Agent Manipulation: When a developer asks their AI agent to ‘fix unresolved Sentry issues,’ the agent queries Sentry via MCP and receives the injected event. The agent cannot distinguish this from legitimate guidance.
Step 5: Code Execution: The agent executes attacker-controlled npm packages with the developer’s full privileges.
Proof: Controlled Validation
- 2,388 organizations found exposed with valid injectable DSNs via passive reconnaissance
- 100+ AI coding agents acted on injected errors in controlled validation
- 85% exploitation success rate against injected errors across Claude Code, Cursor, and Codex
- Confirmed execution at Fortune 500 enterprise (~2B+ hosting provider, scientific computing firm, and startups
Authorized Intent Chain
The attack bypasses EDR, WAF, IAM, VPN, Cloudflare, and firewalls — because there is nothing malicious to detect. Every action in the chain is authorized. Tenet calls this the Authorized Intent Chain: the prevailing security model is built to catch unauthorized behavior, and this attack contains none.
Prompt-layer defenses failed. Agents executed the payload even when explicitly instructed through detailed system prompts and skills to ignore untrusted data.
Vendor Response
Disclosed to Sentry on June 3, 2026 as soon as the chain was confirmed. Sentry’s leadership responded the same day – acknowledging the issue but declining to fix it at the root, calling it “technically not defensible” and noting that model vendors run middleware against it. During the research period, Sentry activated a global content filter blocking a specific payload string – detecting the activity without addressing the cause.
Tenet’s view: if the platform owner considers this class of attack “not technically defensible” at the source, the only place left to stop it is at the agent’s runtime – in the moment it decides to act.
Conclusion
The risk is not limited to Sentry. Any MCP tool integration that returns externally-influenced data to AI agents creates the same vulnerability class. As the AI agent ecosystem expands and more tools connect via MCP, the attack surface grows exponentially.