Agentjacking Attack Aims Artificial Intelligence Agents

Tenet Security announced a new attack class called "agentjacking" in research published on June 12, 2026. Attack is blooding artificial intelligence coding agents such as Claude Code, Cursor and Codex through a fake Sentry error report. Tenet informs that the 2.388 organization is open and the high success rate is achieved in tests. In this article, how the attack works, why the existing security tools can not be captured, and the developers can take precautions.

What is Agentjacking and Why Dangerous?

Agentjacking is an attack class based on aggression injecting hidden commands to the Sentry error events of a attacker and addressing artificial intelligence coding agents. According to the news published in The Hacker News Attack is triggered by a fake error report prepared on the open source error monitoring and performance tracking platform called Sentry. The researchers Ron Bobrov, Barak Sternberg and Nevo Poran states that the attack has a architectural deficit in the intersection of two systems.

"The event intake of Sentry (which accepts random data from anyone who has theDSN) and the Sentry MCP server (which rotates this data as a reliable system output to artificial intelligence agents) reveals a architectural deficit in the intersection. "

The source of danger is this cover trust. When a developer says "corrected Sentry errors" to an artificial intelligence agent, the agent queries Sentry and accepts the incoming response as a developer. The agent cannot distinguish the injected malicious instruction from a legitimate solution step.

How Does Attack Work Step?

The chain of the attack consists of several stages. According to Cloud Security Alliance’s research note The attacker only injects malicious instructions to error events using an Sentry DSN. DSN is an identification information that can be read in everyone, only has the authorization to write; it can be discovered from browser JavaScript or GitHub search. The only thing Saldurga needs is any HTTP client that can send the POST request.

Tenet Security’s own blog post The steps transferred are as follows:

1. Saldurgan sends a fake error event to Sentry with public DSN.

2. Markdown is injected carefully formatted to error message and context areas.

3. This Markdown becomes visually and structurally distinguishable from Sentry’s own solution guide when it is drawn by an artificial intelligence agent.

4. When the developer said "corrected Sentry problems", the agent queries Sentry through MCP and receives the injected event.

5. The agent runs a npm package in aggressive control, stating a legitimate diagnostic step.

6. The package works with full system authorization of the developer.

The package run in the controlled test of Tenet is downloaded from the npm registry and carries a security scan header for responsible description. The same mechanism can be used to run arbitrary code if in a real attack.

Why Cann’t We Want Available Security Tools?

In addition to the most disturbing of the attack, no one of the traditional defenses is activated. According to analysis published in GBHackers Agentjacking; EDR, WAF, IAM controls, VPN, Cloudflare and firewalls are completely thrown. The reason is simple: every step in the attack chain is technically authorized.

Tenet calls it as "Fire Chain" (Authorized Intent Chain). The developer was authorized by artificial intelligence agent, the agent was authorized by MCP link, the MCP connection also returns data from Sentry, a reliable service that the developer is clearly integrated. No abnormality alarm is not triggered because each step is authorized. The current security model was established to capture unauthorized behavior, if the attack does not contain any unauthorized steps.

The defenses in the layer of prompt do not work. According to the findings transferred in Cybersecurity News Even when the system commands clearly said to ignore data that are not trusted to agents, agents run aggressive loads. This situation confirms that the weakness is not a wrong configuration, the existing models are drinking the MCP tool output format. So the problem is not an error that can be closed with patch, a architectural issue.

Which Agents and How many Institutions Are Affected?

Affected agents, the most widely used AI coding assistants. The following table outlines the basic numbers revealed in the tests of Tenet.

Shopping CartAccording to the information compiled in The researchers detected 2,388 organizations with injectable DSN and observed high success rate in tests. A part of open organizations is located in the first 1 million list of global Tranco, which shows that the targets are spread to every sector. Another dangerous and scalability of the attack: thousands of projects can be injected simultaneously when a load is prepared.

This attack is part of the new risk surface that occurs by the prevalence of artificial intelligence coding tools. Artificial intelligence code writing tools Home In-depth introduction to developer workflow, telemetry and error tracking platforms also make attack goal. Developers apply daily free artificial intelligence coding tools As the ecosystem grows, the security of external services connected by these vehicles is also critical.

Why did Sentry Applied Permanent Solution?

Tenet reported his findings to Sentry on June 3, 2026. According to the news published in CyberPress Sentry has accepted the problem but the root refused the correction application and defined the attack class as "technically defendable" at the platform level. Instead, a global content filter for certain load strings has been activated.

The approach of Sentry is controversial because the content filter is intended only a known load string; it is possible to produce new variations that will skip the filter of the attackers. My wider output is: each MCP integration that rotates external impact open data carries a similar risk. The available artificial intelligence models can not reliably distinguish the opener data from embedded instructions, especially when these instructions are in apparently reliable logs, metrics or error messages. A similar threat profile, harmful artificial intelligence models Home It was previously reviewed in the context.

How Can Developers Protect?

Protection requires a multi-layer approach rather than a single patch. Given the architectural nature of the attack, practical steps that developers can skip are:

Limit MCP integrations: Only connect external services that are really necessary to artificial intelligence agent. Review integrations that rotate external impact open data.

Watch agent actions: Observe the commands operated by the agent, especially the npm package installations and script executions. Add confirmation step instead of automatic operation.

Check DSN exposure: Check where the Project Sentry DSN is open. Although DSN has to be public, it is necessary for the defense plan to know that it is injectable.

Apply at least authorization principle: isolate the environment where the agent works. Use a restricted shell or virtual environment instead of full system authorization.

These measures do not completely eliminate the attack but narrow down the attack surface. The main solution depends on the development of the ability to distinguish the data from the instruction on the vehicle output of artificial intelligence models.

Frequently Asked Questions

What is Agentjacking?

Agentjacking is an attack class that is announced in June 2026 by Tenet Security and reduces artificial intelligence coding agents to run malicious code with fake error reports. Saldurgan injects hidden instructions to error events using a public Sentry DSN. The agents such as Claude Code, Cursor and Codex run this instruction by stating a legitimate solution step.

Does Claude Code and Cursor be affected by this attack?

Yes, Claude Code, Cursor and Codex's in the tests of Tenet Security were verified that the injected Sentry incidents were unable to distinguish from the legitimate diagnostic guide and run aggressive commands. The attack reveals the cover trust that these agents are out of the external vehicle. The problem is not a single break, drink the MCP data processing format of agents.

Does Agentjacking need phishing for attack?

No, the agentjacking does not require phishing. Saldurgan only needs a Sentry DSN embedded in public and frontend JavaScript. Because this credentials are open to everyone by design, it can perform the attack without blooding the attacker user or sending malware.

Have you solved the problem?

Sentry has accepted the problem but the root refused the correction application and described the attack as "technically defendable" at the platform level. Instead, a global content filter for a specific load string has been activated. This filter can be vaccinated by producing new variations of the attackers.

How to protect AI when using coding agent?

Limit MCP integrations to protect only with necessary services, add approval step to the commands that the agent is running, delet DSN exposure and run the agent with at least authorization in an isolated environment. These steps narrow the attack surface but the architectural problem does not completely solve; the main solution depends on the ability to distinguish the instruction with the data of models.

Agentjacking shows that the AI agent ecosystem can turn into the command-control channel of observation platforms as it expands with MCP integrations. The agent will gain priority in the coming period of working time security, which will depend on the prevalence of such attacks and not being widespread.