A new attack vector targeting AI-assisted development pipelines has been documented, and it exploits a fundamental trust gap between coding agents and their data sources. Dubbed Agentjacking by Tenet Security, the technique uses Sentry’s error ingestion to inject malicious instructions that AI agents like Claude Code and Cursor treat as legitimate diagnostic guidance.

The attack chain is deceptively simple. An attacker obtains a Sentry Data Source Name (DSN) — a public, write-only key often embedded in web pages — and posts a crafted error event to Sentry’s ingest endpoint. The event contains markdown that mimics Sentry’s own resolution templates. When a developer asks their AI agent to “fix unresolved Sentry issues,” the agent queries Sentry via the Model Context Protocol (MCP) and receives the malicious event. The agent then executes the attacker’s code with the developer’s full system privileges.

This works because MCP servers return data as trusted system output, and the AI agent has no mechanism to distinguish between a real crash report and an injected payload. The attacker never touches the victim’s infrastructure — every action is authorized, which means EDR, WAF, and IAM policies see nothing anomalous.

Tenet tested this against over 100 organizations, achieving an 85% success rate across popular coding assistants. They identified 2,388 organizations with exploitable DSNs. Sentry acknowledged the issue but declined to patch it, calling it “technically not defensible,” though they activated a global filter for a specific payload string.

From an architecture standpoint, this highlights a systemic vulnerability: any external data source that an AI agent trusts implicitly becomes a potential injection point. The fix isn’t just about Sentry — it requires agents to validate or sandbox instructions from external services, or to treat all MCP responses as untrusted input until proven otherwise.

Source: The Hackers News