On June 12, 2026, Tenet Security published research on an attack class it named agentjacking. The setup is ordinary: a development team connects its coding agent to Sentry through MCP so the agent can read production errors and propose fixes. The attack is also ordinary. A Sentry DSN is a public, write-only credential, discoverable from browser JavaScript or a GitHub search. Anyone with it can POST an error event. Tenet posted events whose Resolution sections contained instructions, including shell commands.
What the agents did
Claude Code, Cursor and OpenAI Codex CLI retrieved the injected events over MCP, did not distinguish them from legitimate application errors during triage, and acted on them. Tenet reported 85 percent exploitation success across the three agents and identified 2,388 organizations with injectable DSNs, with more than 100 confirmed in controlled testing. Sentry declined remediation, describing the class as not defensible at ingestion, which is a fair statement of the architecture: an error tracker exists to accept events from untrusted clients.
Why detection missed it
The Cloud Security Alliance's research note makes the structural point. EDR sees a trusted process, the coding agent, running a legitimate package manager command on behalf of the developer. No malicious binary, no unusual parent process, no exploit. The malicious act is a package install the agent believed was a fix. The authorization model was intact the entire time; the agent was authorized to do everything it did.
What to do
- 01Treat every MCP integration that surfaces externally controlled content, error trackers, ticketing, chat, email, as an injection channel. Read the CSA note before the next one is connected.
- 02Keep coding agents on a resolver policy that allows the project's registries and repository host and holds everything first-seen, in CI and on workstations.
- 03Rotate any DSN found in public JavaScript into a server-side relay where possible, and monitor Sentry projects for events with instruction-like Resolution text.
- 04Require human approval for package installs proposed from an integration, not only for shell commands.