Agentjacking Exploits Sentry MCP to Make AI Coding Agents Run Malicious Code

Tenet Security disclosed Agentjacking, an attack that abuses public write-only Sentry DSNs and Sentry’s Model Context Protocol (MCP) integration to inject attacker-controlled error content into AI coding assistants including Claude Code and Cursor. In the reported attack chain, a forged Sentry event is returned to the agent as seemingly trusted diagnostic or remediation guidance, leading the agent to execute attacker-specified commands on a developer workstation without phishing, malware delivery, or prior compromise of the victim environment.

The researchers said they found 2,388 organizations with injectable DSNs and observed an 85% success rate in controlled testing across more than 100 organizations, including confirmed cases of real agent execution. Their proof of concept used an npm package launched via a code block command to validate access to local secrets such as environment variables, Git credentials, private repository URLs, and user identity data, then send limited metadata to a Tenet-controlled beacon server. Sentry acknowledged the issue and reportedly deployed a global content filter for a specific payload string, while Tenet argued the weakness reflects a broader architectural risk in AI agents that consume externally influenced data through MCP-like integrations.