Agentjacking: One Fake Error Report Can Hijack Your AI Coding Agent — 2,388 Orgs Exposed

You thought your AI coding assistant was just helping you fix bugs. It might be executing instructions planted by a hacker.

Three key facts

Security firm Tenet Security disclosed a new attack class in June called "Agentjacking" that lets attackers hijack AI coding agents through Sentry error tracking. The attack is deceptively simple: Sentry's Data Source Name (DSN) is a public, write-only credential typically embedded in website frontend code — anyone can find it. Once an attacker obtains a target's DSN, they send a crafted error event to Sentry's ingest endpoint with malicious instructions embedded inside. When the AI coding agent reads this "error," it treats the malicious instructions as legitimate remediation guidance and executes them — essentially an indirect prompt injection attack.

Researchers tested the most popular AI coding agents on the market and achieved an 85% success rate. Affected tools include Claude Code, Cursor, and Codex. A successful attack can exfiltrate environment variables, Git credentials, private repository URLs, and developer identities — no phishing emails or prior server compromise required. The researchers found at least 2,388 organizations exposed with valid injectable DSNs.

This exposes a structural flaw in AI coding agents: they cannot distinguish trusted instructions from malicious input. AI coding agents connect to external tools like Sentry through interfaces such as MCP (Model Context Protocol), but these interfaces lack trust boundary validation. An agent sees an error message from Sentry and defaults to trusting and executing its contents, with zero verification of whether the message was actually generated by Sentry. Attackers exploit precisely this break in the chain of trust.

WangDou's Take

The most ironic part: developers set up AI agents to automatically fix bugs, and the "automatic bug-fixing" process itself became the bug. Sentry DSNs are public — dig through any website's frontend source and you'll find one — and AI coding agents receive an "error report" and start executing the instructions inside without a second thought. An 85% success rate means 5 out of every 6 agents fall for it, and among those 2,388 exposed organizations there's probably the backend of a SaaS product you're using right now. This isn't one tool's bug — it's the entire AI agent ecosystem collectively going commando on trust. Everyone's shouting that Agentic AI is the future, but if you can't even verify "who actually sent this message," that future is built on quicksand.

Source: The Hacker News — Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code