Computing Life · Share · YageJun 16, 2026, 08:00 UTC+8

Agentjacking: Fake Sentry errors hijack Claude Code with 85% success rate

Agentjacking：一段假错误报告，85% 概率劫持你的 Claude Code

Tenet Security disclosed Agentjacking: attackers submit fake Sentry error events using your publicly exposed frontend DSN, embedding malicious commands disguised as fix suggestions. When your AI coding agent pulls Sentry issues via MCP and auto-fixes bugs, it follows the injected instructions 85% of the time. Tests covered 100+ instances across Claude Code, Cursor, and Codex. Passive scanning found 2,388 organizations with exposed DSNs, including a ~$250B Fortune 500 company. Every step in the chain is authorized—EDR, WAF, and firewalls see nothing. The root cause isn't Sentry; AI agents can't distinguish data they read from instructions to act. The same pattern has been confirmed in WhatsApp MCP, web scraper MCP, Cursor rules files, Claude Code file reads, and RAG systems. Smarter prompts won't fix this because trusted instructions and untrusted data merge into the same token stream with no architectural boundary. Sentry declined a root-cause fix, adding only a bypassable content filter. Current defenses—sandboxing, least privilege, human approval—only limit blast radius, not the injection itself.

Why it matters: Tenet Security's Agentjacking disclosure is the first systematically validated supply-chain attack on the MCP ecosystem—85% success rate, 2,388 exposed orgs, Fortune 500 victims, all with hard data. It exploits design trust rather than a vulnerability, leaving EDR/WAF complete...

Read the original ↗Export Markdown

Take

This one's worth opening because the attack chain is absurdly clean: no exploits, no bypasses, every step is authorized. An attacker uses your publicly exposed frontend Sentry DSN to submit a fake error event, embedding a malicious command disguised as a fix suggestion. When Claude Code pulls Sentry issues via MCP and auto-fixes bugs, it follows the injected instructions 85% of the time.

Tenet Security tested 100+ instances across Claude Code, Cursor, and Codex. Passive scanning found 2,388 organizations with exposed DSNs, including a ~$250B Fortune 500 company. EDR, WAF, firewalls see nothing—because every step is legitimate.

The problem isn't Sentry. WhatsApp MCP, web scraper MCP, Cursor rules files, Claude Code file reads, RAG systems—same pattern confirmed across the board: attackers hide instructions in data the agent reads, and the agent executes them. Simon Willison calls this a confused deputy problem—the agent has your full permissions but is manipulated by untrusted data to act on the attacker's behalf.

The unsettling part is the defense result: smarter prompts don't fix this. LLMs architecturally cannot distinguish trusted instructions from untrusted data—they merge into the same token stream. Same root cause as SQL injection, where the fix wasn't smarter databases but parameterized queries that separate code from data at the format level. In the agent context, no equivalent mature solution exists yet. Sentry added only a bypassable content filter and declined a root-cause fix.

Current defenses—sandboxing, least privilege, human approval—only limit blast radius, not the injection itself.

Source: Computing Life · Share · Yage · yage.ai
Published: Jun 16, 2026, 08:00 UTC+8 · Jun 16, 2026