Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Tenet Security researchers Ron Bobrov, Barak Sternberg, and Nevo Poran disclosed "Agentjacking," which exploits a flaw at the intersection of Sentry's event ingestion (accepting arbitrary payloads from anyone with the DSN) and the Sentry MCP server (returning that data to AI agents as trusted system output).
- Sentry Data Source Names (DSNs) are the entry point: attackers find a target's public DSN, send a malicious error event with carefully formatted markdown that renders identically to Sentry's system template, and wait for a developer to prompt their AI agent to "fix unresolved Sentry issues."
- A successful exploit exposes environment variables, Git credentials, private repository URLs, and developer identities — running with the developer's full privileges without requiring phishing or prior server compromise.
- Tenet identified at least 2,388 organizations with valid injectable DSNs and tested the attack against 100+ organizations, achieving an 85% exploitation success rate against injected errors across widely used AI coding assistants.
- Sentry acknowledged the issue but declined to fix it, calling it "technically not defensible," while activating a global content filter that blocks only a "specific payload string."
- The attack bypasses EDR, WAF, IAM, VPN, Cloudflare, and firewalls because, as Tenet put it, "there is nothing malicious to detect — every action in the chain is authorized."
Why it matters: Sentry's decision not to fix the flaw, calling it "technically not defensible," leaves at least 2,388 organizations exposed through their own public DSNs. Because the attack rides entirely over trusted MCP responses and legitimate developer prompts, it evades every layer of traditional security infrastructure — turning the AI coding agent itself into the attack surface.
