NewsAgency

Agentjacking

Properties1
aliasesAgent Jacking, AI Agent Hijacking via Observability

2 dakika okuma süresi

This page may contain stale information. Last updated: 2026-06-12

Definition

Agentjacking is an attack class disclosed by Tenet Security (June 2026) that hijacks ai-coding-tools by injecting crafted instructions into external observability data — demonstrated via sentry error events — which agents retrieve through model-context-protocol and execute as trusted remediation guidance.

Key Points

  • No breach required: Uses public Sentry DSN (write-only credential embedded in frontend JavaScript)
  • Attack chain: Inject fake error → agent queries Sentry via MCP → agent executes attacker’s npx/npm command with developer privileges
  • Success rate: 85% in Tenet’s controlled tests against Claude Code, cursor, and codex
  • Exposure scale: 2,388 organizations with injectable DSNs found via passive reconnaissance
  • Bypasses: EDR, firewalls, IAM, VPNs via authorized-intent-chain
  • Prompt defenses fail: Agents executed payloads even with explicit instructions to ignore untrusted data

Attack Flow

sequenceDiagram
    participant Attacker
    participant Sentry as Sentry Ingest
    participant Dev as Developer
    participant Agent as AI Coding Agent
    participant MCP as Sentry MCP Server

    Attacker->>Sentry: POST fake error (public DSN)
    Dev->>Agent: "Fix unresolved Sentry issues"
    Agent->>MCP: Query unresolved errors
    MCP->>Sentry: Fetch events
    Sentry-->>MCP: Injected error with fake Resolution
    MCP-->>Agent: Trusted structured output
    Agent->>Agent: Execute npx attacker package

Vendor Response

  • Tenet disclosure to Sentry: June 3, 2026
  • Sentry response: Acknowledged issue; declined root fix (“technically not defensible”); added payload content filter only

The 85% success rate is from Tenet's controlled testing — not confirmed in-the-wild exploitation at scale.

Mitigation

  • Treat MCP tool output as untrusted input, not authoritative system data
  • Restrict agent terminal/shell permissions and MCP connector scope
  • Require human approval for package installs and shell commands
  • Runtime agent security controls at execution decision point

Sources

Grafik Görünümü

Backlinkler