Researchers disclose 'Agentjacking,' an MCP injection attack that hijacks AI coding agents via Sentry

Security researchers have disclosed a new attack that hijacks AI coding agents by feeding them fake error reports, and the platform at the center of it does not plan to patch the flaw at its root. Tenet Threat Labs published the technique in June 2026, calling it 'Agentjacking,' an injection attack that targets agents including Claude Code, Cursor, and Codex through the Model Context Protocol (MCP).

The mechanism abuses two systems working as designed. Sentry's event ingestion accepts arbitrary error payloads from anyone holding a project's Data Source Name (DSN), and the Sentry MCP server later hands that data to an AI agent as trusted system output. An attacker submits a crafted Sentry event with embedded instructions; the agent retrieves it through MCP and runs attacker-controlled commands with the developer's own system privileges, Tenet Threat Labs said.

The firm reported an 85% exploitation success rate across the agents it tested and identified at least 2,388 organizations with externally discoverable, injectable DSNs. Those figures come from the researchers. The Cloud Security Alliance issued its own research note documenting the same attack chain, noting that in tested configurations the technique bypassed endpoint detection, web application firewalls, IAM controls, and VPNs because the agent performed only authorized operations under the developer's own credentials, according to the Alliance's analysis.

What gives the disclosure weight is the response. Tenet reported the findings to Sentry on June 3, 2026, and Sentry acknowledged them that day but declined to fix the issue at the platform level, describing the attack class as 'technically not defensible' there and instead deploying a content filter that blocks a specific payload string. No root-cause patch is available, and no CVE had been assigned as of publication.

That leaves mitigation with developers, who can rotate exposed DSNs and restrict which MCP tools their agents may call. The episode points to a structural problem as coding agents wire into more developer tooling: data that an agent treats as trustworthy can be poisoned upstream by anyone able to write to it, and the fix may not sit with the service that delivers the payload.