Agentjacking
Agentjacking: How One Fake Bug Report Can Hijack Your AI Coding Assistant” Target search intent: “is Claude Code safe,” “AI agent security risk,” “agentjacking explained”
If you or anyone on your team uses an AI coding assistant — Claude Code, Cursor, or OpenAI’s Codex — there’s a new attack worth knowing about. It doesn’t involve stolen passwords, malware, or a data breach. It involves your AI agent doing exactly what it’s designed to do.
What’s actually happening
Security researchers at Tenet Security disclosed an attack class they call “agentjacking” in June 2026. Here’s the mechanism, in plain terms.
Sentry, a popular error-tracking tool used by thousands of development teams, uses a public credential called a DSN to receive error reports. That credential is supposed to be public — it’s write-only, meaning someone with it can submit error data but can’t read anything sensitive.
The problem: an attacker can use that public credential to submit a fake error report, carefully formatted to look exactly like Sentry’s own suggested fix. When a developer later asks their AI coding assistant to clean up unresolved errors, the assistant retrieves that fake report through a standard connection (called MCP) and reads the attacker’s instructions as if they were legitimate guidance — then runs them, with the developer’s own system permissions.
Why this is hard to catch
Every individual step in this chain is something the system is supposed to do. The developer approved the agent. The agent is supposed to read Sentry data. Sentry is supposed to accept public error reports. Nothing in that chain trips a typical security alert, because nothing in it is unauthorized — it’s all working exactly as designed, just on fabricated input.
Tenet tested the attack against real organizations and reported an 85% success rate, with at least 2,388 companies found to have exposed, exploitable credentials — ranging from small teams to large enterprises.
What you can actually do about it
This isn’t a flaw with a simple patch, because it’s less a bug and more a structural limitation in how current AI agents process information they’re given. Sentry has acknowledged the report and added a narrow filter for the specific test payload researchers used — but broader fixes are still an open problem.
If your business uses AI coding agents connected to tools like Sentry:
- Treat anything an agent reads from an external tool as unverified, not automatically trustworthy
- Consider adding a human review step before agents act on error-tracking or monitoring data
- Ask whoever manages your dev tools whether any Sentry (or similar) credentials are exposed publicly in your codebase
The bigger picture
This is a useful, concrete example of something AI literacy actually requires: understanding that an AI agent doesn’t “know” what’s trustworthy — it trusts whatever data it’s handed, in whatever format looks official. That’s not a reason to avoid AI agents. It’s a reason to build the same skepticism into how you use them that you’d apply to any new employee with system access.