Agentjacking: A Fake Sentry Bug Hijacks Claude Code

What happened

In mid-June 2026, researchers at Tenet Security (the Threat Labs team) disclosed a new class of attack on AI agents — Agentjacking. The gist: a forged bug report sent to the error-monitoring service Sentry makes a coding agent such as Claude Code or Cursor execute arbitrary code right on the developer's machine.

How it works, step by step:

1. Sentry has a public key called a DSN — by design it is embedded straight into frontend JavaScript and visible to anyone. It is a write-only credential: all you can do with it is send error events.
2. The attacker POSTs a forged error event to Sentry's ingest endpoint. Inside is carefully crafted markdown, visually indistinguishable from Sentry's own remediation guidance.
3. In an ordinary workflow, the developer asks the agent: "fix the unresolved errors in Sentry."
4. The agent pulls the event through MCP (Model Context Protocol) and reads the malicious instruction as a trusted directive.
5. The agent runs the attacker's command — installing an attacker-controlled npm package, for example — with the developer's privileges.

Per Tenet, using only Sentry's public APIs and breaking into nothing, the researchers found 2,388 organizations with exposed DSNs. In controlled tests, agents at more than 100 organizations — from Fortune 500 companies to independent developers — actually executed the injected code. The claimed exploitation success rate is 85% against leading AI assistants (Claude Code, Cursor, Codex).

What can leak: environment variables (AWS keys, GitHub and Sentry tokens), git credentials, private repository addresses, developer identifiers — all quietly, to the attacker's server.

According to The Hacker News, Sentry acknowledged the issue but declined to fix it properly: it only added a global content filter blocking one specific payload string. Tenet responded by open-sourcing agent-jackstop, a set of ready-made configs that harden Cursor and Claude Code against this class of injection.

Why it matters

The core danger is that every step of the attack is authorized. No phishing, no breaking into anyone's server, no user action beyond the normal workflow. EDR, WAF, IAM, VPN and firewalls see nothing suspicious: the malicious payload is run by a trusted application (the agent itself) as the developer, at machine speed.

This is classic prompt injection, but with a new delivery vector: not through a web page or an email, but through a legitimate monitoring tool the team trusts. The agent cannot tell real diagnostics from a markdown injection — to it, both are simply "data from Sentry."

And the problem is not limited to Sentry. VentureBeat points out that the same principle applies to Datadog, PagerDuty and Jira — to any source that feeds an agent untrusted external data through MCP. Agentjacking, in other words, is not one vendor's bug but a systemic hole in how agents consume external context.

What it means for vibe coding

If you give an agent access to integrations (Sentry, issue trackers, monitoring), you are effectively extending your attack surface to all the external content that lands there. Practical conclusions:

• Do not let the agent auto-run commands anywhere it reads untrusted data. Keep a confirmation step before shell commands and package installs.
• Treat the contents of bug reports, tickets and alerts as untrusted input — even when the source is "yours." The injection arrives through content, not through a breach.
• Isolate the environment: run the agent in a sandbox/container with minimal secrets in environment variables, separate tokens and restricted repository permissions.
• Check your DSNs: a Sentry public key is open by definition, which is exactly why the "agent fixes errors from Sentry" flow deserves a human review gate.
• Look at Tenet's open-source agent-jackstop configs as a starting defense for Cursor and Claude Code.

Agentjacking is a vivid reminder: the convenience of "the agent will go and fix it itself" also means that anyone who can put a string into your data pipeline can potentially put a command into your terminal.

Sources

• The Hacker News — Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
• Tenet Security — One Fake Bug Report Hijacked a $250B Company's AI Agent
• The New Stack — A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
• VentureBeat — The attack that hijacked Claude Code came through Sentry. Datadog, PagerDuty, and Jira have the same exposure
• Infosecurity Magazine — New "Agentjacking" Attacks Could Hijack AI Coding Agents