A fake Sentry error was enough to make AI coding agents run attacker code

What changed

On June 9, 2026, Tenet Security's Threat Labs published research on an attack it calls "agentjacking" (Tenet Security). The post was republished on June 17 under a new title and has been updated since. It is vendor research, not a peer-reviewed study, and Tenet sells a security platform for AI agents.

The attack starts from a key that is public by design. Sentry's documentation says DSNs "are safe to keep public because they only allow submission of new events and related event data," and they sit in the JavaScript of countless production sites. The same page acknowledges "a risk of abusing a DSN, where any user can send events to your organization with any information they want," which it calls rare. Tenet uses exactly that: it posts a crafted error event whose markdown mimics Sentry's own remediation guidance, including a fake "Resolution" section with an npx command. When a developer asks a coding agent to fix unresolved Sentry issues, the agent fetches the event through Sentry's MCP server and runs the command with the developer's privileges.

What the research actually shows

Read from the post, kept separate from what anyone makes of it:

• Exposure. Through passive reconnaissance (Censys indexing, code search and CDN loader extraction), Tenet found 2,388 organizations with valid, injectable DSNs. 71 of them rank in the Tranco top one million sites.
• Success rate. Across "controlled validation waves," more than 100 AI coding agents acted on injected errors, including Claude Code, Cursor and Codex. Tenet reports "an 85% exploitation success rate against injected errors."
• Real targets. Validation ran against real organizations' developers, including, by Tenet's account, a Fortune 500 enterprise. Its test package checked that environment variables existed, measured the size of credential files such as ~/.aws/config and ~/.npmrc, and reported back. Tenet says the telemetry confirmed that AWS credentials, Kubernetes tokens, GitHub OAuth tokens and git repository URLs were present and reachable, and that no probe data was kept.
• Nothing to detect. "Every step is authorized, which is why no security control sees it," in Tenet's words: a public key, Sentry's own ingest API, the agent's own tool call, the developer's own shell.
• The vendor response. Tenet disclosed to Sentry on June 3, 2026. Per Tenet, Sentry acknowledged the issue the same day but declined to fix it at the root, calling it "technically not defensible" and noting that model vendors run middleware against it. Sentry activated a global content filter that blocks a specific payload string.

What it means for an engineering team

An MCP tool result is untrusted input. Error events, tickets, logs and issue comments are written, at least in part, by whoever can reach them. An agent that reads them over MCP is reading attacker-writable text with the developer's privileges. Treat every tool that returns third-party data the way you would treat a web page.

Do not let agents run what a tool result suggests. Require approval for shell commands and package execution (npx, pip, a script piped to a shell) in coding agents, and avoid blanket allow rules for them. The attack depends on the suggested command running without a person reading it first.

Shrink what a hijacked agent can reach. The damage came from what sat in the developer's environment: cloud keys, tokens and git credentials. An agent that triages production errors should run without long-lived cloud credentials in reach, ideally in a container that cannot read the host's credential files. In a health organization, check whether a developer's workstation holds credentials to systems that store protected health information. If it does, this is a path to them.

Know which DSNs are public. Sentry offers IP blocking and DSN rotation for abuse. Those limit the noise, but they do not make event content trustworthy, so they do not replace the controls above. Tenet has also published drop-in hardening configurations for Cursor and Claude Code, agent-jackstop.

What is still unsettled

Whose flaw this is. Sentry treats the public DSN as working as designed and points to model vendors' defenses. Tenet calls it an architectural flaw at the meeting point of Sentry's ingestion and its MCP server. Until one of them owns that seam, the defense falls to whoever runs the agent.

How the 85% was measured. The post does not publish per-agent results, the prompts the developers used or the agent configurations, so the figure cannot be compared across tools or reproduced.

How far it generalizes. The research covers Sentry. Any MCP server that returns content a third party can write, such as an issue tracker, a support inbox or a chat channel, has the same shape, and the post does not measure them.

Sources

• Bobrov, R., Sternberg, B. and Poran, N. One Fake Bug Report Hijacked a $250 Billion Company's AI Agent – Then 100+ More. Tenet Security Threat Labs, first published June 9, 2026 as "A Fake Bug Report Hijacks Your AI Coding Agent - and Nothing Catches It.", republished June 17, 2026. Retrieved September 22, 2026.
• Sentry. Data Source Name (DSN). Sentry documentation. Retrieved September 22, 2026.