Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code

Cybersecurity researchers at Tenet Security have identified a new class of attack called Agentjacking, which tricks AI coding agents into executing arbitrary code on developer machines. The attack exploits a critical architectural flaw at the intersection of Sentry’s event ingestion and the Sentry MCP server. By injecting crafted input into Sentry error events via a public Data Source Name (DSN), attackers can cause coding agents like Claude Code and Cursor to interpret malicious instructions as legitimate diagnostic resolution steps. This can lead to exposure of sensitive data, including environment variables, Git credentials, and private repository URLs, without requiring phishing or prior server compromise. The attack chain involves finding a target’s DSN, sending a malicious error event, and prompting the AI agent to fix Sentry issues, resulting in code execution with the developer’s full privileges. Tenet Security found at least 2,388 organizations with exposed injectable DSNs and achieved an 85% exploitation success rate in controlled tests. Sentry acknowledged the issue but opted not to fix it, stating it is ‘technically not defensible,’ though it activated a global content filter. The attack bypasses traditional security measures like EDR, WAF, IAM, VPN, Cloudflare, and firewalls because every action is authorized.