Source: The Hacker News

What Actually Happened

Researchers at Tenet Security have identified a new attack vector dubbed ‘Agentjacking’ that exploits AI coding agents, enabling attackers to execute arbitrary code on developer machines. The attack leverages a vulnerability in Sentry, an open-source error-tracking platform, specifically targeting its event ingestion process that accepts arbitrary payloads. By crafting malicious error reports, attackers can manipulate AI agents like Claude Code and Cursor into executing unwanted code, effectively compromising sensitive data without traditional attack vectors like phishing.

The Implementation Reality

This incident highlights a critical architectural flaw where AI coding agents inherently trust responses from the Sentry MCP (Model Context Protocol) server. The attack begins with the discovery of a target’s Sentry Data Source Name (DSN), a public credential that allows anyone to post messages to the Sentry instance. An attacker sends a maliciously crafted error event via a POST request to Sentry’s ingest endpoint. When a developer prompts their AI agent to resolve Sentry issues, the agent inadvertently executes the attacker’s code, which runs with developer privileges. This creates a severe security risk as it bypasses common security measures like Endpoint Detection and Response (EDR) and firewalls, since the actions appear legitimate and authorized.

What to Do About It

• Audit your Sentry DSNs in use across your organization to identify any that may be publicly accessible. Implement access controls to limit exposure.
• Educate developers about the risks associated with executing commands based on external error reports and encourage skepticism towards AI-generated recommendations.
• Consider implementing monitoring solutions that can analyze Sentry event payloads for unusual patterns or structures that deviate from standard error reporting.
• Explore alternative methods for error handling and diagnostics that include validation and sanitization of external inputs to AI coding agents.
• Stay informed on updates from Sentry and monitor for any security patches or configuration changes that can mitigate this risk.

Source: The Hacker News

At q52, we specialize in AI-augmented security operations and SIEM implementation. Let us help you operationalize threat detection with LLM enrichment — faster triage, fewer false positives, and security intelligence your team can actually act on. Learn about Noogenesis, our AI-powered SIEM platform and connect with us on LinkedIn.