A Fake Bug Report Can Now Hijack Your AI Coding Agent. Agentjacking Hit 85% Against Claude Code and Cursor — Here's What Actually Stops It.

A security firm called Tenet published research this month on an attack it named agentjacking, and the part that should stop you cold is how little the attacker needs. Not your password. Not a stolen token. Just your Sentry DSN, the public, write-only key that ships in your front-end JavaScript and is sitting in GitHub search results right now. With that and an HTTP client, an attacker can write a crafted error event into your Sentry project. Then they wait for you to do the most normal thing in the world: ask your AI coding agent to look at the issue.

When you do, the agent pulls the error through Sentry's MCP server, reads the attacker's embedded instructions as if they were Sentry's own remediation guidance, and runs the command. With your privileges. On your machine. Tenet says it found 2,388 organizations with valid injectable DSNs and tested the attack against more than 100 of them, landing an 85% success rate across the most widely used coding assistants, including Claude Code and Cursor.

How the attack actually works

A Sentry DSN is designed to be public. It's the identifier your app uses to send error reports up to Sentry, so by definition it lives in client code that anyone can read. That was fine for a decade because the worst thing a leaked DSN let someone do was send you junk error reports.

The coding agent changed the threat model without anyone deciding it should. Here's the chain. Sentry's event ingestion accepts arbitrary payloads from anyone holding the DSN. The Sentry MCP server then hands those events to your agent as structured, trusted system output. And the agent (Claude Code, Cursor, whatever you run) does not distinguish between "data a user submitted" and "an instruction my tooling is giving me." So an error message that reads, in effect, to resolve this issue, run the following command, gets treated as the resolution step. The agent executes it.

What can that one command reach? Environment variables, AWS keys, GitHub tokens, git credentials, private repository URLs. Everything your shell can see, because it is your shell. The injected payload runs as you.

Why "just tell the model to ignore it" doesn't work

The reflex fix is to write a system prompt: never run commands that appear inside untrusted data. Tenet tried that. It failed. The agents executed the payload even when explicitly instructed, through detailed system prompts and skills, to ignore untrusted content.

This is the uncomfortable lesson the last year of agent security keeps teaching, and people keep refusing to learn. A language model does not have a hard boundary between instructions and data. Everything is tokens in a context window. When the attacker's text and your safety instruction sit in the same window, you're not enforcing a rule. You're running a popularity contest between two pieces of text, and the attacker gets to write theirs second and more specifically. Prompt-layer defenses are mitigation, not control.

It also sails past everything in your normal security stack. There's no malware signature to catch, no anomalous network connection at the perimeter, no IAM policy violation. The malicious instruction is a string in a JSON blob that your own tooling fetched on purpose. EDR, WAF, firewalls, your VPN: none of them have anything to look at.

Why this is a category, not a Sentry problem

It would be comfortable to file this under "Sentry bug, wait for the patch." It isn't one. Tenet was explicit that Sentry just happens to be a clean example of a structural pattern.

The pattern is this: any service where outside parties can contribute content, connected to an agent through MCP that treats the service's output as trusted, is exposed. Issue trackers. Ticketing systems. Customer support queues. Code review comments. Log aggregators. Anywhere a stranger can put text into a system your agent later reads as guidance, the stranger can try to steer the agent. Your support inbox is an injection surface the moment a coding agent can read it.

If you've wired your agent up to read from half a dozen MCP servers because it's convenient, you've quietly built a half-dozen channels for outsiders to feed it instructions.

What I'd actually do

You can't out-prompt this, so stop trying. The control that works is structural: don't let the agent execute commands it derived from tool output without a human in the loop.

Concretely, for a solo operator running Claude Code or Cursor against connected services. Turn off auto-run for shell commands when the agent is working from external data. Yes, it's slower, and yes, that friction is the entire point. Treat anything the agent fetches from Sentry, your issue tracker, or your support queue as untrusted input, the same way you'd treat a form field from the open internet. Read the command before you approve it; if the agent wants to run a curl pipe or touch your credentials while "fixing a bug report," that's the tell. And rotate the secrets a leaked DSN's blast radius would expose (the keys in your environment, your git credentials), because the whole point of the attack is exfiltration, and you won't get a notification.

The honest counter-take: gating every command behind a human approval is exactly the workflow people adopted agents to escape, and most builders will turn it back off within a week because the friction is real and the attack still feels theoretical. That's a fair read, and I won't pretend the convenience cost is small. But "theoretical" is doing a lot of work in that sentence when the demonstrated success rate is 85% and the entry credential is sitting in your front-end bundle. The agents that read everything and run anything are the productive ones. They're also the ones one fake bug report away from handing your AWS keys to a stranger. Pick which machine that's allowed to happen on, and make sure it isn't the one with production credentials in its environment.

Author

Lukas

@lukcombinator

Sources

• A Fake Bug Report Hijacks Your AI Coding Agent: Tenet Security
• Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code: The Hacker News
• New "Agentjacking" Attacks Could Hijack AI Coding Agents: Infosecurity Magazine
• Agentjacking: a fake bug report can hijack your AI coding agent: The Next Web