Hook

2,388 organizations exposed. One HTTP POST to a public Sentry DSN. That's all it takes to hijack an AI coding agent. The floor didn't hold. Tenet Security dropped this at DEF CON 34, and the market is still pricing in a false sense of security.

Context

Most people think this is about AI model vulnerabilities. It's not. It's about trust boundaries in data pipelines. The attack combines two legitimate design decisions: Sentry's error ingestion endpoint accepts any POST with a valid DSN (no authentication), and AI coding agents like Cursor and Claude Code use MCP (Model Context Protocol) to read Sentry issues as context for debugging. Neither is a bug on its own. Together, they create a credential theft machine.

Here's the truth: The attacker doesn't need to exploit a zero-day. They just need to find a public Sentry DSN—Tenet found 2,388—then POST a malicious error event containing an indirect prompt injection payload. When a developer asks their AI agent to "fix the Sentry error," the agent reads the event, interprets the markdown as instructions, and executes it. The payload: npm install a malicious package that steals AWS keys, GitHub tokens, OAuth credentials, and registry tokens.

Core

The attack chain is mechanically sound. Six steps, each documented in the disclosure:

1. Scan for public Sentry DSNs (GitHub, public repos, leaked configs).
2. POST a crafted error event using the DSN. The payload includes a markdown block that looks like a "fix" command.
3. Developer triggers their AI agent to investigate the Sentry issue (e.g., "Why is this error happening?").
4. MCP injects the Sentry event data into the agent's context. The agent sees the markdown as a legitimate instruction.
5. The agent executes the instruction: npm install malicious-package.
6. The malicious package steals credentials from the developer's environment.

This is a combinatorial attack, not a novel exploit. I've audited similar supply chain risks in DeFi and traditional CI/CD pipelines. The pattern is always the same: two systems that are individually secure become dangerous when their trust boundaries intersect. Sentry's DSN is a write-only key—it's designed to accept data from anyone. MCP's design assumes tool output is benign context. The intersection creates a backdoor that bypasses all model-level guardrails.

Tenet's controlled test showed 85% success rate across 100+ organizations. That number is plausible under ideal conditions: developer actively debugging, agent given full context, no human oversight. In real-world scenarios, the success rate will be lower, but the damage potential is higher because attackers can target specific developers—like those with access to production infrastructure.

Sentry's response is a content filter. They deployed a payload-specific blacklist. That's a band-aid. Attackers can obfuscate the markdown, change the package name, or use alternative execution vectors. The root cause remains: DSNs are not authenticated for write operations, and MCP does not distinguish between data and instructions.

Contrarian

Most people think this is about AI security. It's not. It's about supply chain trust in data pipelines. The real vulnerability is the protocol's assumption that "data" and "instructions" are separable. In an AI agent, any piece of data can become an instruction if the model is trained to follow patterns. The model has no built-in mechanism to ask: "Is this a command from my user, or is it data from an external source?"

The market is overreacting in the wrong direction. Everyone is rushing to buy "AI agent security" tools. But the real alpha is in structural solutions: mandatory authentication on data ingestion endpoints, instruction separation at the protocol level, and zero-trust for all agent inputs. Content filters are not a solution. They are a temporary patch that will be bypassed within weeks.

The 85% success rate is a headline, not a floor. In real-world deployments, the attack requires a specific chain of events: developer must actively query the agent about a Sentry issue, the agent must have MCP access to Sentry, and the developer must approve the execution (or have auto-approve enabled). Many enterprises already disable auto-approve. But the attack surface is still massive: 2,388 organizations exposed, 71 in the top 100 websites, 27% of Fortune 1000 companies via Cloudflare MCP. That's a lot of surface area.

The floor didn't hold because Sentry refused to fix the root cause. They said it's "technically untenable" to add authentication. That's a business decision, not a technical one. Adding DSN authentication would change their product's core value proposition—easy, frictionless error ingestion. They chose customer experience over security. That's a bet that will cost them when the first big breach hits.

Takeaway

The market is now oversold on 'AI agent security' as a buzzword. The real alpha is in structural solutions: mandatory data source authentication, instruction separation at the protocol level, and zero-trust for agent inputs. If you're investing in AI coding tools, look for those that have already implemented these safeguards. The rest are sitting ducks. Token rotation, network egress whitelists, and command approval are necessary but not sufficient. The architecture must change. Until then, every public Sentry DSN is a loaded weapon pointed at your developer's machine.

The question is not if this attack will be weaponized at scale. It's when. And when it happens, the market will realize that the most valuable AI security product is not an agent—it's a firewall between the agent and the data it consumes.

Based on my audit experience, the most dangerous attacks are not the ones that break new ground. They are the ones that connect two innocent systems. Agentjacking is precisely that. The market is still pricing in a false sense of security. The floor didn't hold.