Agentjacking: How Fake Sentry Errors Hijack Claude Code and Cursor (2026)

One HTTP POST. No credentials required. 85% success rate against Claude Code, Cursor, and Codex — simultaneously. On June 12, 2026, Tenet Security researchers Ron Bobrov, Barak Sternberg, and Nevo Poran disclosed agentjacking: a novel attack class that exploits AI coding agents through manipulated Sentry error reports. The exposure math is sobering — 2,388 organizations are at simultaneous risk, and the only prerequisite is a publicly accessible Sentry DSN.

This isn't a vulnerability in Sentry. It isn't a vulnerability in Claude Code or Cursor or Codex individually. It's a trust model mismatch — Sentry was designed before AI agents existed, and the design decision that made DSNs public (they have to be in client-side JavaScript) creates an attack surface that didn't exist until AI agents started reading observability data and executing diagnostic steps based on what they find there.

The Attack in Precise Terms

Sentry Data Source Names are embedded in JavaScript bundles that ship to browsers. Every user who opens Chrome DevTools on your app can read the DSN. This was an acceptable design when the only consumers of Sentry data were dashboards viewed by engineers and alert pipelines that pinged on-call. It stops being acceptable when an AI coding agent has Sentry read access through MCP and treats error content as authoritative context for autonomous action.

The attack sequence:

1. Attacker locates a target's Sentry DSN — via GitHub search, browser DevTools, Shodan, or any public JavaScript bundle
2. Attacker sends an HTTP POST to Sentry's ingest endpoint using that DSN (no authentication required — that's the design)
3. The POST payload contains a fake error with an embedded shell command inside the stack trace, error message, or breadcrumb data
4. The AI coding agent discovers the "error" via Sentry MCP, interprets it as a real production incident, and begins autonomous investigation
5. The agent executes the embedded command — typically reading environment variables and POSTing them to an attacker-controlled server

The entire chain requires no prior access to the target's infrastructure. Tenet demonstrated running it against 2,388 organizations simultaneously — which is either a compelling proof of concept or the most scalable attacker setup in recent memory, depending on your vantage point.

Why 85% Works

Tenet tested three agents: Claude Code, Cursor, and Codex. All three treat Sentry data as trusted context by default. That's the correct product decision — an agent that constantly second-guesses its connected tools generates unusable noise. The problem is the trust model doesn't distinguish between data that your application wrote to Sentry and data that any internet user wrote to Sentry via a public DSN.

The 15% failure rate came from two sources: agents running under restricted shell execution policies (explicit configuration, not defaults) and cases where a malformed error structure triggered validation warnings before the agent reached the execute phase. Neither is a reliable defense. Both are implementation accidents that a targeted attacker can probe around with minimal effort.

The specific payload Tenet used targeted Sentry's extra field — structured data that AI agents read as diagnostic context. The embedded command looked enough like a diagnostic instruction that the agent treated it as a suggested next step rather than an untrusted string. That's prompt injection at the observability layer, and the defenses against it are architectural, not syntactic.