Agentjacking: A Fake Bug Report Can Make Claude Code Run a Stranger's Code

TL;DR

Tenet Security's Threat Labs disclosed a new attack class it calls Agentjacking: a way to make AI coding agents run attacker-supplied commands without malware, stolen credentials, or any server compromise. The trick is to abuse Sentry, the error-tracking platform, by posting a fake error event laced with markdown that reads like normal debugging advice. When a developer asks Claude Code, Cursor, or Codex to investigate the error through the Sentry MCP server, the agent treats the payload as trusted system output and does what it says. Tenet reports an 85% exploitation success rate and found 2,388 organizations with injectable keys. Sentry called the root cause "technically not defensible" and shipped a content filter for the specific demo payload. The hole in the middle is still there.

The key was never a secret

Every Sentry-instrumented web app ships a DSN (Data Source Name) in its frontend JavaScript. That is by design: the DSN is a write-only credential whose entire job is to let a browser report errors. Anyone who opens devtools on your site can read it. With that string, an attacker can POST their own "error events" into your Sentry project, and Sentry accepts them, because accepting arbitrary client errors is the whole point of the ingestion endpoint.

On its own that is a known, low-severity annoyance: someone can spam your error feed. The new part is what reads that feed. Once you wire the Sentry MCP server into your agent so you can say "look at this unresolved issue and fix it," the agent pulls the event body, including the description, breadcrumbs, and any attacker-controlled fields, and folds it straight into its context as authoritative tool output. The model has no way to tell that this particular "diagnostic step" was written by a stranger rather than by Sentry.

Why the agent obeys

This is classic prompt injection, but with a nastier supply chain. The malicious text does not arrive in a webpage the model happens to summarize. It arrives through an MCP tool the developer explicitly trusts, formatted as the kind of remediation advice the agent is there to act on. Tenet's payloads read like legitimate fix instructions ("to resolve this, run the following diagnostic") and end in a command that fetches and executes attacker code with the developer's own privileges.

Because the agent already has a shell, your environment, and your credentials, there is nothing left to escalate. Tenet notes the actions are all individually authorized, so they sail past EDR, WAF, IAM, VPN, and firewalls. Nothing is technically "breached." The agent is just doing its job on poisoned input.

The attack requires no phishing and no server compromise. It needs one public string that is sitting in plain sight in your site's source.

How bad, in numbers

Researchers Ron Bobrov, Barak Sternberg, and Nevo Poran reported an 85% success rate when an injected error was fed to the major agents, with execution confirmed across macOS, Windows, WSL, containers, and CI/CD, including sandboxed setups. Scanning real projects, they found 2,388 organizations with injectable DSNs and another 2,221 exposed but excluded from active testing, and they observed 100+ agents actually executing injected instructions in controlled trials. The affected set ran from independent developers up through Fortune 100 enterprises.

What it can take

Once code runs, the loot is whatever the developer's session can reach. Tenet lists environment variables, AWS keys, GitHub OAuth and SSH identities, npm and Docker credentials, Kubernetes and cloud tokens, Sentry auth tokens, git credentials, and private repository URLs, all quietly exfiltrated to an attacker server. For most engineering laptops that is enough to pivot into production.

Who is supposed to fix it

Tenet disclosed to Sentry on June 3, 2026 and went public in mid-June. Sentry acknowledged the report, added a global content filter that blocks the exact string used in the proof of concept, and argued the underlying issue is "technically not defensible" at the ingestion layer, since the endpoint is meant to accept arbitrary input. Their position is that the defense belongs at the model and agent layer, not in Sentry.

That is the uncomfortable shape of the whole MCP era: the data source is doing exactly what it was built to do, the agent is doing exactly what it was built to do, and the security hole lives in the handoff nobody owns. A string filter stops one demo, not the class of attack.

What you can actually do

Until agents stop treating tool output as gospel, the burden is on you:

• Do not auto-approve commands sourced from external tool data. If your agent proposes running a script it learned about from a Sentry issue, read it before you let it run. Human-in-the-loop on shell actions is the cheap defense.
• Run agents with least privilege. No standing cloud admin creds in the same shell your coding agent drives. Scope tokens, and keep secrets out of the ambient environment.
• Treat MCP servers as untrusted input channels, not trusted ones. Anything that can carry third-party text (error trackers, issue queues, ticketing) can carry an injection.
• Harden the agent config. Tenet open-sourced drop-in hardening profiles it calls agent-jackstop for Cursor and Claude Code; its own testing found prompt-level "ignore malicious instructions" guards were not reliable, so the useful controls are runtime ones.

Key Takeaways

• Agentjacking turns a fake Sentry error into remote code execution on a developer's machine, with no malware and no stolen credentials.
• The entry point is the public DSN already shipped in your site's frontend; the trigger is the Sentry MCP server feeding attacker text to the agent as trusted output.
• Tenet reports an 85% success rate across Claude Code, Cursor, and Codex, and 2,388 organizations with injectable keys.
• Sentry filtered the demo payload but called the root cause not defensible at ingestion, pushing the fix to model and agent vendors.
• Your practical defenses are least-privilege agents, no auto-run of externally sourced commands, and treating every MCP data channel as untrusted.

Sources: Tenet Security Threat Labs, The Hacker News