Cybersecurity researchers have identified what they describe as a new class of attack capable of tricking artificial intelligence (AI) coding agents into executing arbitrary code on developers' machines.
Dubbed Agentjacking by Tenet Security, this attack can be initiated using a fake error report created via Sentry, an open-source platform for error tracking and performance monitoring.
"The attack exploits a critical architectural flaw at the intersection of Sentry's event ingestion (which accepts arbitrary payloads from anyone with the DSN) and the Sentry MCP server (which returns this data to AI agents as trusted system output)," according to security researchers Ron Bobrov, Barak Sternberg, and Nevo Poran.
The strategy involves injecting crafted input into Sentry error events, which coding agents such as Claude Code and Cursor then interpret as legitimate diagnostic resolution steps, ultimately executing attacker-controlled code.
A successful exploit of this nature can expose sensitive data, including environment variables, Git credentials, private repository URLs, and developer identities, without relying on methods like phishing or prior server compromise.
The issue stems from the implicit trust placed in connections to external services via the Model Context Protocol (MCP). Since an AI agent cannot differentiate between an error event from a real application crash and one injected by an attacker, this creates a pathway to arbitrary code execution when the agent processes the response.
The attack chain developed by Tenet proceeds as follows:
An attacker identifies a target's Sentry Data Source Name (DSN), a public, write-only credential embedded in websites.
The attacker sends a malicious error event to Sentry's ingestion endpoint via a POST request using the DSN.
The injected event includes "carefully formatted markdown" in the message field and context key names. When the Sentry MCP server returns this event to an AI agent, it appears as structured content visually identical to Sentry's system template.
When a developer asks their AI coding agent to "fix unresolved Sentry issues" (or a similar prompt), the agent queries Sentry via MCP and retrieves the malicious event.
The agent executes malicious code, which runs with the developer's full privileges.
"The attacker never touches the victim's infrastructure," the researchers explained. "The malicious instruction arrives disguised as a legitimate 'Resolution' inside an ordinary error. When a developer asks their AI agent to fix the Sentry issue, the agent reads the attacker's command as trusted guidance and runs it - with the developer's own privileges, on the developer's own machine."
Agentjacking stands out because it targets the AI agent a developer trusts and uses a Sentry DSN as a starting point. Additionally, the markdown injection is rendered so that the agent cannot distinguish it from legitimate Sentry guidance.
The AI cybersecurity firm reported finding at least 2,388 organizations exposed with valid injectable DSNs, and it tested the attack in a controlled manner against over 100 organizations, achieving an 85% exploitation success rate against injected errors across some of the most widely used AI coding assistants.
Sentry has acknowledged the issue but opted not to fix it, stating it is "technically not defensible." However, the company is said to have activated a global content filter that blocks a "specific payload string."
"As enterprises race to deploy AI coding agents, this research proves the agents themselves are now the attack surface - turned against the developers who trust them, using nothing but data those organizations publish about themselves," Tenet said. "The attack bypasses EDR, WAF, IAM, VPN, Cloudflare, and firewalls - because there is nothing malicious to detect. Every action in the chain is authorized."