Agentjacking Hijacks AI Coding Agents to Run Malicious Code

Key Takeaways

• A new attack, dubbed “Agentjacking,” allows attackers to execute arbitrary code on developer machines by manipulating AI coding agents like Claude Code and Cursor.
• The attack leverages Sentry’s public Data Source Names (DSNs) to inject malicious Markdown into error messages, which AI agents then interpret as legitimate instructions.
• Tenet researchers identified 2,388 organizations with vulnerable DSNs and demonstrated successful code execution in over 100 real-world cases across various industries.
• The attack chain appears benign to traditional security defenses, as it relies on authorized tools and workflows, highlighting a systemic risk in AI agent integrations.
• Sentry has implemented a content filter, but the researchers emphasize that a broader, model-side mitigation is needed to address this “Authorized Intent Chain” vulnerability.

Agentjacking: Hijacking AI Coding Agents Through Injected Errors

A sophisticated new attack vector, termed “Agentjacking,” has emerged, enabling threat actors to silently execute malicious code on developer workstations by compromising artificial intelligence (AI) coding agents. This novel technique exploits the interaction between error monitoring platforms and AI assistants, turning trusted tools like Claude Code and Cursor into conduits for attacker-controlled commands without requiring traditional phishing, malware, or direct infrastructure breaches.

The entry point for Agentjacking is the publicly exposed Data Source Name (DSN) associated with Sentry, a popular error tracking platform. DSNs are write-only credentials frequently embedded in frontend JavaScript and are indexed across the internet, making them readily discoverable.

Researchers at Tenet conducted extensive passive reconnaissance, employing methods such as JavaScript inspection, Censys searches, CDN loader analysis, and code search. Their investigation uncovered 2,388 organizations with exploitable DSNs, including 71 entities within the Tranco top 1 million websites, indicating a widespread potential attack surface.

Armed solely with a Sentry DSN, an attacker can submit arbitrary error events to Sentry’s ingest API. This capability allows full control over various fields, including messages, tags, context, extra data, breadcrumbs, user information, stack traces, and fingerprints. Sentry processes these fabricated events as legitimate application errors, inadvertently allowing malicious content to infiltrate monitoring workflows.

The fundamental architectural vulnerability lies at the intersection of Sentry’s event ingestion pipeline and its Model Context Protocol (MCP) integration. This integration feeds error data directly to AI coding agents, treating it as trusted system output rather than potentially untrusted external input.

How Agentjacking Works

Attackers craft specific Markdown payloads embedded within injected error messages, particularly within the message and context fields. This malicious Markdown is designed to influence how content is presented to AI agents. The injected content can mimic a legitimate Sentry “Resolution” section, complete with headings, code blocks, and tables, making it virtually indistinguishable from genuine remediation guidance.

When a developer instructs their AI agent to “fix unresolved Sentry issues,” the agent queries Sentry via MCP, retrieves the crafted event, and interprets the attacker’s embedded command as legitimate diagnostic or corrective steps. Critically, the AI agent does not recognize this as untrusted input.

Tenet demonstrated a proof-of-concept payload where agents were directed to execute an npx command. This command pulled a controlled validation package from the public npm registry and ran it with the developer’s full local privileges. In their controlled testing, this package performed reconnaissance by probing environment variables, checking the sizes of configuration files like ~/.aws/config and ~/.docker/config.json, and inspecting network interfaces. Subsequently, it transmitted scoped exposure metadata back to a Tenet beacon server under explicit “ResponsibleDisclosure [SECURITY SCAN]” headers.

Tenet reported over 100 confirmed instances of real-agent execution across a diverse range of organizations, including a Fortune 500 cloud enterprise, a multi-billion-dollar hosting provider, scientific software firms, startups, and individual developers. The attacks achieved an impressive success rate of approximately 85% across leading AI coding agents.

The “Authorized Intent Chain” and Systemic Risk

What makes Agentjacking particularly insidious is its ability to operate entirely within authorized parameters, rendering it invisible to conventional security measures. Sentry is used as intended, DSNs are publicly accessible by design, npm packages are fetched through standard channels, and the AI agent executes commands as part of its normal workflow. Endpoint detection and response (EDR) systems, Web Application Firewalls (WAFs), Identity and Access Management (IAM) policies, and network firewalls detect no apparent policy violations because the observed behavior aligns with a developer-approved tool running approved commands on a trusted observability platform.

Tenet describes this as an “Authorized Intent Chain,” arguing that current security models, which primarily focus on blocking unauthorized actions or malicious binaries, lack the necessary visibility into attacks that leverage trusted contexts and legitimate tool outputs. The research underscores that Agentjacking is not merely a single-vendor bug but represents a systemic vulnerability inherent in AI agent ecosystems.

Any MCP integration that feeds externally influenced data to AI agents carries a similar risk, as such data can contain hidden instructions controlled by attackers. Current AI models struggle to reliably differentiate descriptive data from embedded instructions, especially when these instructions are disguised within seemingly trusted logs, metrics, or error messages.

Mitigation and Future Outlook

Tenet disclosed its findings to Sentry on June 3, 2026. Sentry acknowledged the issue and subsequently implemented a global content filter for a specific payload string. However, Sentry reportedly characterized the underlying attack class as “not technically defensible” at the ingestion layer, suggesting that mitigation efforts should primarily reside with model vendors through model-side middleware.

What You Should Do

• Audit AI Agent Integrations: Review all tools and platforms that your AI coding agents interact with. Assess whether these integrations accept untrusted or anonymous input that could be manipulated.
• Implement Runtime Controls: Establish stringent runtime controls to prevent injected content from automatically translating into code execution on developer endpoints. This may involve sandboxing AI agent execution environments or requiring explicit developer confirmation for commands.
• Enhance Input Validation for AI Agents: Develop and deploy advanced input validation mechanisms for AI agents that can distinguish between legitimate diagnostic data and potentially malicious embedded instructions, even within trusted log or error messages.
• Monitor for Anomalous AI Agent Behavior: Implement monitoring solutions that can detect unusual command execution patterns or data exfiltration attempts initiated by AI agents, even if the actions appear to be part of a legitimate workflow.
• Educate Developers: Train developers on the risks associated with AI agent interactions and the potential for “Authorized Intent Chain” attacks. Emphasize the importance of scrutinizing AI agent-generated commands before execution, especially when dealing with error resolution.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.