Grego — Cybersecurity
For years we’ve secured the development pipeline by asking ourselves a single question: who is authorized to do this? Firewalls, EDR, IAM, WAF — the entire stack is built to catch the unauthorized. New research from Threat Labs, the team at Tenet Security, published on June 9, demonstrates a class of attack that walks right through all of that, precisely because every step is authorized. They call it agentjacking, and if your team is running Claude Code, Cursor, or Codex against MCP integrations, it’s worth understanding exactly what they tested.
The mechanism is almost insultingly simple. Sentry — the error monitoring platform — ingests events through a DSN, a write-only credential that Sentry deliberately documents as safe to embed in frontend JavaScript. It lives in the public source code of countless production sites by design. Anyone with that DSN can POST a fabricated error event to Sentry’s ingest endpoint: no authentication beyond the DSN, no breach, no exploit in the traditional sense. The attacker controls the entire payload — message, tags, context keys, stack traces.
The trap springs in the next step. When a dev asks their agent to “fix unresolved errors from Sentry”, the agent queries Sentry through its MCP server and receives the injected event as trusted system output. Tenet’s payload embeds markdown in error fields that renders as a fake ## Resolution section — structurally indistinguishable from Sentry’s own remediation guide — containing an npx command. The agent reads the attacker’s instruction as legitimate diagnostic advice and executes it, with the dev’s full privileges, on the dev’s own machine.
That’s the entire chain. A fake bug report to remote code execution, and the dev sees only harmless diagnostic output while the agent delivers whatever the environment exposes: AWS keys, GitHub tokens, git credentials, private repo URLs.
What Tenet actually measured — and what they didn’t
This is important to be precise about, because numbers have impact and are easy to inflate. This was controlled research, not a wave of in-the-wild attacks. Using only passive reconnaissance — Censys indexing, code search, CDN loader extraction — Tenet identified 2,388 organizations with valid injectable DSNs, 71 of them in the Tranco top-1M, at the time of their June reconnaissance. In controlled validation waves they recorded 100+ agents acting on injected errors across Claude Code, Cursor, and Codex, an exploitation success rate of 85% against the most-used agents on the market. Confirmed executions ranged from a Fortune 500 company to independent devs — and notably, a cloud security vendor was among the exposed. No data was retained from the probes; affected organizations were notified.
So the honest framing is: a proof-of-concept demonstrated at scale, not evidence of active exploitation. That distinction matters. But it doesn’t soften the conclusion much, because the barrier to turning the PoC into a real campaign is, according to Tenet’s own account, minimal — the same conditions exist in thousands of projects, reachable with trivial resources.
Why usual defenses see nothing
This is the part that should hold a CIO’s attention. Tenet calls it the Authorized Intent Chain: every action in the attack is something that dev tooling is permitted to do. The DSN is public by design. Posting an event is normal. The agent querying Sentry is normal. Executing a suggested command is the agent doing its job. EDR, WAF, IAM, VPN, firewalls — none of them trigger, because there’s nothing unauthorized to catch.
And prompt-level defenses failed too. Tenet reports that agents executed the payload even when system prompts and skills explicitly instructed them to ignore untrusted data. The weakness lies in how current models process output from MCP tools — they can’t reliably separate data they read from an instruction to act. As Tenet puts it, this doesn’t get fixed with a better prompt.
Which is also why it would be a mistake to file this away as “a Sentry problem”. Tenet is explicit that no vulnerability in Sentry itself was exploited — the entry point is a credential that Sentry intends to be public. Upon notification, Sentry acknowledged the issue and deployed a content filter for the specific payload string, but characterized the underlying class as technically indefensible at the ingest layer, pointing instead to a mitigation on the model side. Read fairly, that’s a defensible position: the ingest endpoint can’t know whether an agent downstream will treat its output as an instruction. Sentry is simply the demonstrated entry point. The vulnerable pattern — an MCP tool that returns data influenced by third parties to an agent that trusts it — is shared across the entire ecosystem.
The question for your team
The instinct will be to ask “do we patch Sentry?”. That’s the wrong question. The right one is: which MCP tools do our agents read from, and which of them return data that someone outside our organization can influence? Error logs, ticketing systems, monitoring dashboards, issue trackers, scraped web content — any of them can be a delivery vector for the same class of injection. Each new MCP integration broadens the surface.
The uncomfortable corollary is where control has to live. If network and identity layers can’t see it, and the prompt layer can’t stop it, then the only place left to enforce policy is in the agent’s runtime — the moment it decides to act on what it read. That’s an architectural gap that most teams deploying coding agents still haven’t filled, and the teams in Latin America adopting these tools at full speed are no exception. Agentjacking is the first widely documented proof that the gap is exploitable. It won’t be the last.
The deeper shift is one worth letting settle. Supply chain attacks used to require compromising an actual package or deceiving a human. With agents in the loop, an attacker needs neither — just data the agent trusts. The observability platform becomes the command channel, and the agent becomes the execution engine. We spent a decade learning not to trust user input. The next lesson is that our agents still don’t know how to.