2,388 organizations exposed. 85% success rate. Zero new vulnerabilities exploited.
That's not a typo. It's the cold, hard reality of what Tenet Security presented at DEF CON 34. The attack is called 'Agentjacking,' and it's the most elegant and terrifying supply chain attack I've seen since the SolarWinds debacle. But unlike SolarWinds, this one doesn't target a single software vendor. It targets the very tool you're using to write your code: the AI coding agent.
As a Crypto Hedge Fund Analyst, I've spent 14 years watching data flows and trust boundaries. My ISTJ brain lives for patterns and details. And what I saw in this research sent a chill down my spine. It's not about a new zero-day. It's about a fundamental architectural flaw in the current AI agent stack. The data itself becomes the weapon.
Let me walk you through the chain. The attack leverages a perfect storm: the public Sentry DSN, the Model Context Protocol (MCP), and the AI agent's inherent trust in external data. It's a combination of three 'legitimate' design decisions that, when combined, create a massive, scalable attack surface.
The Hook: The Public Sentry DSN
Sentry is an error monitoring platform used by millions of developers. It's a critical tool. To send errors, you need a Data Source Name (DSN). Think of it as a unique API key. The problem? Many developers accidentally leave their DSNs exposed in public code, logs, or even their package.json files. A simple git grep can find them. Tenet found 2,388 organization-level public DSNs. That's a lot of low-hanging fruit.
The Context: The MCP Integration
Now, enter the AI coding agent. Claude Code, Cursor, and others use the Model Context Protocol (MCP) to connect to external tools. They can read your Sentry issues, your Jira tickets, your Slack messages. The agent imports this data into its context to help you debug and fix problems. It's a productivity godsend. But it's also the open door.
The Core: The Attack Chain
Here's the sequence. Step one: the attacker finds a public DSN. Step two: they send a crafted error event to Sentry's ingestion endpoint. This event is a POST request. It's a phishing email, but for the agent. Step three: the developer asks their AI agent to 'check the latest Sentry errors.' The agent queries Sentry via MCP. Step four: the agent sees the attacker's crafted error. Inside the error's stacktrace or extra data, there's a markdown block that looks like a fix. The agent, being a helpful tool, interprets this as a directive. It says, 'I see a fix. Let me run npm install malicious-package to patch this.' Step five: the agent executes the command. The malicious package is installed. It's game over. The attacker now has access to the developer's machine—AWS keys, GitHub tokens, npm registry credentials, you name it.
The real story is that this is not a 'model' hack. It's a 'trust boundary' hack. The model is working perfectly. It's doing exactly what it was trained to do: follow instructions and fix problems. The problem is that the model cannot distinguish between 'data' and 'instructions' at the semantic level. The markdown code block in the Sentry error looks like a fix. The agent treats it as one. This is a classic Indirect Prompt Injection, weaponized for a real-world, high-value workflow.
The Contrarian Angle: It's Not a Bug, It's a Feature of the Architecture
What most people miss is that this isn't a vulnerability in Sentry, MCP, or the AI model. It's a feature of the architecture. Tenet's mitigation, agent-jackstop, is a band-aid, not a cure. It adds network whitelists, command approval dialogs, and subprocess credential protection. All good practices. But they don't change the fundamental architecture: the agent's context is a trust domain, and any data that enters it can influence its actions.
Sentry's response was to deploy a 'content filter' for specific payload strings. This is an IoC-based blacklist. It's a cat-and-mouse game. The attacker changes the payload slightly, and the filter is bypassed. Sentry's argument that a platform-level fix is 'technically infeasible' is a convenient truth. It would require a fundamental change to their ingestion model, which is their core business. They'd rather patch the symptom than the disease.
The Takeaway: The MCP Security Standard is the Next Frontier
The future of agent security isn't about better filters. It's about a new protocol layer. The MCP specification needs a 'trustworthiness declaration' for every piece of data. Every tool output should carry a label: 'This is data, not an instruction.' The model should be trained to treat external data with a different level of authority. This is a hard problem. But it's the only way to build a trustable agent ecosystem.
The attack on the 2,388 organizations hasn't happened yet. But the blueprint is public. The question is not 'if' but 'when' a low-sophistication attacker will automate this and run it at scale. The window for proactive defense is closing. The next time you ask your AI agent to 'fix this bug,' remember: it might be fixing a bug that was planted to fix you.
