Agentjacking: Fake Bug Report Hijacks AI Coding…

Tenet Security researchers demonstrated on June 12, 2026 that a poisoned Sentry error report can hijack Claude Code, Cursor, and Codex to execute arbitrary code with the developer's privileges. The attack achieved an 85% success rate in controlled tests and affects 2,388 organizations exposing public Sentry DSNs. No patchable software vulnerability is exploited; the attack weaponizes the architectural assumption that AI agents treat all external data as legitimate instruction.

Tenet Security researchers demonstrated on June 12, 2026 that a fake bug report inserted into Sentry can hijack AI coding agents to execute arbitrary code with the developer's privileges. The attack achieved an 85% success rate in controlled tests. The attack exploits no patchable software vulnerability; it exploits the architectural assumption that agents treat any external data as legitimate instruction.

Key Takeaways

Tenet Security tested Claude Code, Cursor, and Codex: all three executed hidden payloads in a fake error report with an 85% success rate
2,388 organizations publicly expose the Sentry DSN, allowing unauthenticated insertion of the poisoned bug report insertion
The attack bypasses EDR, IAM, firewalls, and VPNs because every step is authorized: the agent reads data, interprets it as guidance, and executes it
Sentry responded to the June 3, 2026 disclosure that the issue is "technically indefensible" at root, adding only a filter for a specific payload string

The Mechanism: When the Model Context Protocol Becomes a Command Channel

AI coding agents — Anthropic's Claude Code, Anysphere's Cursor, OpenAI's Codex — use the Model Context Protocol (MCP) to retrieve contextual data from external tools. Sentry, an error monitoring platform used by over 200,000 organizations according to vendor data, is a common source.

The mechanism Tenet Security discovered is elegant in its simplicity. Agents do not distinguish between data read and instructions to execute: all content retrieved via MCP is treated as valid contextual input. An attacker inserts a fake error report with a "Resolution" section containing hidden commands. When the developer asks the agent to "fix Sentry errors," the agent retrieves the poisoned report, interprets the hidden commands as legitimate diagnostic guidance, and executes them with the developer's privileges.

The Sentry DSN (Data Source Name), publicly exposed by 2,388 organizations identified by Tenet, allows insertion without authentication. This endpoint is designed to receive client-side telemetry: its legitimate function becomes the attack surface.

"The agent read it, trusted it, and ran our code with the developer's own access. Every step was authorized, so IAM, EDR, and network controls had nothing to flag"
— Barak Sternberg, CEO Tenet Security

The Authorized Intent Chain: Invisible by Definition

Tenet Security coined the term "Authorized Intent Chain" to describe what makes the attack impervious to traditional controls. No credential compromise occurs, no software vulnerability is exploited, no anomalous traffic appears. The agent does exactly what it was designed to do: retrieve data, analyze it, act. Every step is authorized by the existing permission system.

Barak Sternberg, CEO and co-founder of Tenet Security, reported that safety prompts added to the agent — explicit instructions to ignore untrusted input — proved ineffective. "We told agents to distrust the input; they ran the payload anyway," he stated. Partial mitigations fail or, in the extreme case, render the agent unusable: an agent that cannot trust any external data can no longer operate.

The payload Tenet demonstrated can steal environment variables, AWS keys, GitHub tokens, git credentials, and private repository URLs. The problem potentially extends to any external data source consumed via MCP: support tickets, GitHub issues, documentation. "The flaw is not in Sentry alone. It is in how agents handle any outside data," The Next Web reported in its analysis of the research.

Disclosure and Response: A Problem Declared Indefensible

Tenet Security disclosed the findings to Sentry on June 3, 2026. The vendor's response was nuanced: Sentry added a filter for a specific payload string but deemed the root issue "technically indefensible." This position confirms the researchers' reading: the problem lies in the trust architecture of AI agents, not in an isolated bug in a specific platform.

The specific-string filter offers limited protection. Payload variants that evade the recognized pattern remain effective. Traditional defensive logic — pattern matching, blacklists, security rules — assumes a clean distinction between benign data and malicious commands that the agentic architecture does not guarantee.

No source documents that Anthropic, Anysphere, or OpenAI have released patches or specific guidance for this vector. The exact number of developers or organizations actually compromised remains unknown: sources verify only Tenet's controlled tests, not in-the-wild observation of the attack.

What to Do Now

Verify Sentry DSN exposure: identify whether the organization publicly exposes the DSN and assess removal or access restriction
Review AI agent trust architecture: implement separation between data retrieval and execution layers, with explicit command validation before execution
Introduce human-in-the-loop for sensitive actions: require human confirmation before the agent executes commands that modify repositories, credentials, or deployment environments
Monitor intent, not just behavior: traditional controls see authorized actions; it is necessary to trace the provenance of the instructions that generated those actions

Why Agentjacking Redefines the Security Perimeter

Tenet Security's research exposes a structural tension in the deployment of AI coding agents. Companies have invested in these tools to accelerate development, but have extended the attack surface in a way that traverses the public services they use daily. No sophisticated breach is required: a well-crafted bug report in a platform the organization chose to use is enough.

The distinction between data and instruction is a classic problem in computer science, from SQL injection to cross-site scripting. AI agents reprise it in an amplified form: it is no longer the application confusing data and code, but the language model confusing the description of a problem with the solution to apply. The semantic difference, for an agent designed to be "helpful," becomes technically irrelevant.

Concrete consequences include cloud credential theft, private repository compromise, and supply chain poisoning. The ideal target is not exposed infrastructure: it is the developer with legitimate access, whose agent acts with their same privileges. Perimeter security does not help when the attacker enters through the developer's own authorizations.

Frequently Asked Questions

Does the attack only work with Sentry?

No. Sources indicate the problem extends to any external data source consumed via MCP, including support tickets, GitHub issues, and documentation. Sentry is the vector Tenet demonstrated, not the only possible one.

Why don't traditional security controls detect agentjacking?

Because every step is authorized. The agent reads data with legitimate permissions, interprets it as guidance, and executes it with the developer's privileges. No EDR, IAM, or network monitoring rule has a criterion to block an action that matches expected behavior exactly.

Is there a patch for this problem?

Sources indicate Sentry added a filter for a specific payload string but declared the problem "technically indefensible" at root. No patch released by AI agent vendors is documented. Mitigation requires architectural changes, not traditional software updates.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references