Skip to content
News Incident

Agentjacking: Sentry DSN exposure lets attackers hijack Claude Code, Cursor, and Codex

· by Pondero Newsdesk

The short version

Security firm Tenet Security documented a new attack class called agentjacking that injects malicious instructions through publicly exposed Sentry DSNs, achieving an 85% success rate against Claude Code, Cursor, and Codex in controlled testing.

Agentjacking: Sentry DSN exposure lets attackers hijack Claude Code, Cursor, and Codex

Security firm Tenet Security disclosed on June 12, 2026 that every Sentry DSN visible in a JavaScript bundle or a public GitHub repo is an entry point for hijacking AI coding agents. In controlled testing, the attack succeeded 85% of the time against Claude Code, Cursor, and Codex, and Sentry told researchers the platform-level fix is "technically not defensible."

What happened

The attack exploits how AI coding agents fetch Sentry error events through MCP integrations. A Sentry DSN is write-only by design: anyone who finds the credential in a frontend bundle or a public commit can POST arbitrary error events to the project. Tenet Security demonstrated that an attacker can embed malicious instructions inside those error payloads. When a developer's coding agent retrieves the errors via MCP, it reads the injected instructions as if they were legitimate application context and executes them under the developer's own system privileges.

In testing across more than 100 targets, Tenet achieved an 85% exploitation success rate per the CSA research note published June 12. Claude Code, Cursor, and Codex each failed to distinguish injected instructions from real error events. The credentials recovered in proof-of-concept runs included environment variables, AWS credentials, GitHub and GitLab OAuth tokens, npm registry tokens, Docker configuration secrets, and Kubernetes cluster tokens.

Tenet identified 2,388 organizations with injectable Sentry DSNs exposed in public repositories or frontend code. Sentry acknowledged Tenet's disclosure on June 3, 2026 but declined to address the root cause. Per Sentry, restricting event ingestion to authenticated sources or sanitizing payloads before MCP return is "technically not defensible" at the platform level. Sentry implemented only reactive content filtering.

The attack bypasses EDR, firewalls, IAM controls, and VPN protection because it runs on the developer's own authorized credentials. No malware is installed; no network anomaly is generated.

Why it matters

Teams using any AI coding agent that connects to Sentry via MCP are exposed today, and the fix is not coming from Sentry. The 2,388 exposed organizations Tenet counted cover only what was findable in public repositories and bundles. Private codebases with the same pattern are not in that figure.

The exposure goes past Sentry. Tenet's write-up notes that Datadog, PagerDuty, and Jira share the same architecture: integrations that accept unauthenticated writes into a data source the agent later reads. Any observability or ticketing tool in an agent's MCP context through a write-accessible credential is a potential injection surface.

For Claude Code and Cursor users, the immediate step is to audit every connected MCP server and rotate any DSN that appears in a public-facing asset, then keep that credential out of the MCP context until Sentry ships a credentialed ingestion option. The deeper issue is trust model: the MCP server here functions correctly. The agent fails because it treats error-event content as trusted input.

What to watch next

Tenet's disclosure arrived June 12, three weeks before The New Stack, VentureBeat, and The Register picked it up on July 1. Neither Anthropic nor Cursor had published official mitigation guidance as of July 2. Watch for: official sandboxing guidance from either vendor; a credentialed ingestion path from Sentry; and whether Datadog, PagerDuty, or Jira receive comparable disclosures given the shared exposure pattern Tenet flagged.

Sources