It started with a single HTTP POST to a public Sentry DSN. No exploit, no zero-day, no sophisticated payload. Just a researcher sending a crafted error event to an endpoint that accepts any data from anyone. Within minutes, a developer's AI coding agent—Cursor, Claude Code, or any MCP-connected assistant—would read that error, interpret its markdown as a repair instruction, and execute a malicious npm package. The package would then exfiltrate AWS keys, GitHub OAuth tokens, and npm registry credentials. This is not a simulation. At DEF CON 34, Tenet Security demonstrated exactly that: a six-stage attack chain they call Agentjacking, with an 85% success rate across 100+ controlled tests. The attack exploits no model vulnerability. It exploits an architectural blind spot in how we trust the data flowing into our AI agents.
Context: The Marriage of Error Monitoring and AI Coding Agents
To understand the attack, we must first understand the two systems involved. Sentry is a widely used error monitoring platform. It works by ingesting crash reports and exceptions from applications via a Data Source Name (DSN)—a unique identifier embedded in the client code. The DSN is essentially a public key: when an error occurs, the client POSTs the error data to Sentry's endpoint, which is authenticated only by the DSN. This design is intentional: it allows the DSN to be hardcoded in client-side code without requiring per-request authentication. The trade-off is that anyone who knows the DSN can send arbitrary error events to that project. And researchers have shown that public DSNs are easily discoverable via GitHub scraping, npm package inspection, and web crawlers. Tenet's own scan found 2,388 publicly exposed Sentry DSNs belonging to organizations, including 71 in the top 1 million websites and roughly 27% of Fortune 1000 companies reachable through Cloudflare's MCP integration.
On the other side, AI coding agents like Cursor and Claude Code have adopted the Model Context Protocol (MCP) to connect to external tools. MCP allows agents to query databases, APIs, and monitoring services—including Sentry—to assist developers in debugging. The agent reads Sentry issues, interprets the error messages and stack traces, and suggests fixes. The problem is that the agent treats the data returned by MCP tools as authoritative context. It does not distinguish between a legitimate error message and a maliciously crafted one. The architecture trusts the data source implicitly.
Core: The Six-Step Attack Chain—A Technical Breakdown
Tenet's attack chain is a masterclass in composition. It does not rely on any single vulnerability but on the intersection of two design decisions that are individually harmless. Step one: the attacker discovers a public Sentry DSN—easy via GitHub or npm metadata. Step two: the attacker POSTs a crafted error event to Sentry using that DSN. The event contains a markdown payload disguised as a stack trace and a proposed fix. Step three: the developer, working on a codebase that uses Sentry, asks their AI coding agent to investigate a recent error or crash. The agent queries the Sentry MCP server for recent issues. Step four: the agent retrieves the attacker's malicious event. The markdown in the event includes a code block that appears to be a fix for the error. Step five: the agent interprets the markdown as a genuine solution and executes the command—often npm install targeting a malicious package hosted on a registry. Step six: the malicious package contains a postinstall script that steals credentials from the developer's environment: .env files, ~/.aws/credentials, ~/.ssh/ keys, and any OAuth tokens stored by git or npm.
The attack is a variant of indirect prompt injection, but elevated by the MCP data pipeline. The model does not need to be jailbroken; it simply follows instructions embedded in the context it is given. The context comes from a trusted source (Sentry) via a trusted protocol (MCP). The agent's guardrails are bypassed because the injection does not come from user input but from tool output. This is the fundamental architectural flaw: current AI agent architectures lack a semantic layer to distinguish data from instructions.
Tenet's controlled tests showed an 85% success rate. The failures likely occurred when the developer manually reviewed the suggested command before executing it, or when the agent's sandbox blocked network calls. But in the default configuration of Cursor and Claude Code, the agent is often allowed to run shell commands directly. The attack is scalable: an attacker can automate the discovery of public DSNs, inject malicious error events, and wait for developers to trigger the chain. The only prerequisite is that the developer uses an MCP-connected agent that queries Sentry.
Contrarian: The Real Risk Is Not the Attack—It's the Over-Reliance on AI Agents
Most security reports frame Agentjacking as a new vulnerability to be patched. I disagree. The attack is a symptom of a deeper problem: we are outsourcing critical decision-making to systems that cannot distinguish between a data point and a command. The contrarian view is that the real risk is not the attack itself but the false sense of security that AI coding agents create. Developers trust these agents to read their code, access their terminals, and interact with their infrastructure. The agents, in turn, trust any data that comes through MCP. This trust chain is fragile.
Sentry's response is instructive. They deployed a content filter that blocks known payload strings. But that is a band-aid. The root cause—the inability to differentiate data from instructions—remains. Tenet's own mitigation tool, agent-jackstop, enforces network egress whitelists, command execution approval prompts, and subprocess-level credential isolation. These are necessary but not sufficient. They reduce the blast radius but do not eliminate the attack vector. The architecture still allows a malicious MCP response to influence the agent's reasoning.
The contrarian angle also applies to the industry's response. We are seeing a rush to "MCP security gateways" and "AI agent firewalls." But these are reactive measures. The real solution is to embed a trust model into the protocol itself: every MCP response should carry a confidence score, a provenance tag, and a clear separation of data and executable suggestions. Until then, any agent that reads external data is vulnerable.
I have seen this pattern before. In 2017, during the ICO mania, I analyzed over 40 whitepapers and found that the most dangerous projects were not the ones with obvious flaws but the ones that combined two legitimate features into a lethal combination. The same is true here. The public DSN design is not a bug. The MCP integration is not a bug. But together, they create an attack surface that is cheap to exploit and hard to defend.
Takeaway: The Next Narrative Is Trust, Not Speed
The AI coding agent market is booming. Cursor, Claude Code, and others are racing to add features, integrations, and speed. But Agentjacking is a warning: the next competitive advantage will not be how fast your agent can generate code, but how safely it can read the world. Enterprises that adopt AI agents will now demand security audits, MCP data source vetting, and credential isolation. The vendors that prioritize trust over speed will win the long game.
For the crypto industry, this is especially critical. Developers building DeFi protocols, smart contracts, and Layer 2 infrastructure handle the most sensitive credentials. A single compromised AI agent could lead to the loss of deployer keys, governance tokens, or bridge validators. The attack is not theoretical. We burned out trying to own the future, but we forgot to lock the doors.
The silent question remains: how many public DSNs are still out there, waiting for an attacker to POST a single crafted event? The answer is at least 2,388. And the clock is ticking.