Agentjacking: How a Fake Bug Report Can Hijack Your AI Coding Agent and Breach Your Enterprise Network

Security researchers at Tenet Security have documented a new class of attack they are calling Agentjacking, in which a threat actor uses nothing more than a publicly available credential to hijack popular AI coding agents and execute arbitrary code on developer machines inside enterprise networks. The technique requires no malware, no phishing email, no stolen password, and no breach of the target organisation's infrastructure. The AI coding agent itself becomes the weapon.

The attack was published on 12 June 2026 by Tenet Security researchers Ron Bobrov, Barak Sternberg, and Nevo Poran. Their research has since been corroborated by the Cloud Security Alliance, which issued an independent research note confirming the findings.

The entry point is Sentry, the widely used open-source error tracking and application monitoring platform. Sentry is designed so that any application can submit error reports using a Data Source Name (DSN), a write-only credential that is intentionally embedded in frontend JavaScript and is therefore discoverable by anyone who inspects a website's source code, searches GitHub, or uses a tool like Censys. Tenet's researchers used passive reconnaissance methods alone to identify 2,388 organisations with injectable DSNs, including 71 in the Tranco top one million domains. No authentication was required to collect them.

With only the DSN in hand, an attacker can submit any error event to Sentry's ingest API and control the content entirely, including the message text, tags, context fields, stack traces, breadcrumbs, and user information. Sentry accepts these forged events as legitimate application errors, because from its perspective, they are. The malicious content now sits inside a trusted observability platform.

The second architectural condition that makes Agentjacking possible is the Model Context Protocol (MCP). MCP is the standard that allows AI coding agents to connect to external tools and retrieve data from them as trusted system output. When a developer instructs their AI coding assistant to fix unresolved Sentry issues, the agent queries Sentry via MCP, retrieves the injected error event, and reads the attacker's embedded instructions as if they were legitimate remediation guidance.

Tenet demonstrated this with a proof-of-concept payload embedded inside a fake Sentry "Resolution" section, formatted with headings, code blocks, and structured tables that are visually indistinguishable from genuine Sentry diagnostic output. The AI agent, following what appeared to be standard troubleshooting steps, executed an npx command that pulled a controlled package from the public npm registry and ran it with the developer's full local system privileges. The victim saw only benign diagnostics on their screen. The agent was silently probing environment variables, checking the sizes of configuration files including AWS and Docker credentials, and sending scoped metadata to a Tenet-controlled beacon server.

Tenet confirmed more than 100 real-world execution events across a Fortune 500 cloud enterprise, a multi-billion-dollar hosting provider, scientific software firms, startups, and individual developers spanning six continents. The overall exploitation success rate across leading AI coding agents including Claude Code, Cursor, and Codex was approximately 85%.

What makes Agentjacking particularly difficult to detect or block is what Tenet calls the Authorised Intent Chain. The developer authorised the AI agent. The agent authorised the MCP connection to Sentry. Sentry is a trusted platform the developer explicitly integrated. Every action in the chain is authorised. Every observable behaviour matches a developer-approved tool running approved commands. Endpoint detection and response tools, web application firewalls, IAM policies, VPNs, and standard firewalls generated no alerts during Tenet's testing because no policy was violated and no anomaly threshold was crossed.

The research also demonstrated that prompt-layer defences are ineffective against this attack class. Agents executed attacker payloads even when their system prompts explicitly instructed them to disregard untrusted data. This confirms that the weakness is inherent to how current models process MCP tool output, not a misconfiguration that can be patched away by adjusting instructions.

Tenet disclosed its findings to Sentry on 3 June 2026. Sentry acknowledged the issue the same day and introduced a global content filter targeting one specific payload string identified during the research period. However, Sentry declined to address the root cause, describing the attack class as "technically not defensible" at the ingestion layer and pointing to model-side middleware as the appropriate mitigation. Sentry's own leadership characterised the fix as reactive rather than structural.

For enterprise security teams, particularly those in the UAE and Saudi Arabia where AI-assisted development tooling is being adopted at pace across financial services, government, and technology sectors, Agentjacking signals a material new category of AI supply chain risk. The attack surface expands with every MCP integration that returns externally influenced data to an AI agent, not just Sentry.

Security teams should audit which external tools their AI coding agents are permitted to connect to, assess whether those integrations accept anonymous or untrusted input, and evaluate what runtime controls are in place to prevent injected content from translating into code execution on developer endpoints. Organisations should also review whether developer machines have sufficient segmentation from core enterprise systems to limit the blast radius of a successful execution event.

The broader implication, as noted in recent research on Gulf enterprise security readiness, is that current security models were designed to block unauthorised actions. Agentjacking operates entirely through authorised ones. That architectural gap is not patched by adding another tool to the stack. It requires a reassessment of trust boundaries in AI-assisted development environments from the ground up.