Your AI coding agent is not just a productivity tool—it's a potential backdoor. That's the cold reality behind the attack vector disclosed at DEF CON 34, where researchers from Tenet Security demonstrated a chain that uses public Sentry DSNs to hijack Claude Code and Cursor agents. The result? Full compromise of AWS keys, GitHub tokens, and npm registry credentials stored on the developer's machine.
Context: The MCP-Sentry Marriage
The attack exploits the Model Context Protocol (MCP), a standard that allows AI agents like Claude Code and Cursor to read from external tools. Sentry, the popular error monitoring platform, provides an MCP integration that lets agents query recent issues for debugging. The problem? Sentry's ingestion endpoint accepts any POST request containing a valid DSN—no authentication, no signature verification. An attacker can craft a fake error event with a malicious markdown snippet. When the developer asks the agent to check Sentry for a bug, the agent reads the payload, interprets the markdown as a fix instruction, and executes npm install on a malicious package. The package then steals the session's credentials.
Tenet's research scanned the internet and found 2,388 public Sentry DSNs, 71 of which belong to sites in the Tranco top 1 million. Approximately 27% of Fortune 1000 companies were exposed via Cloudflare's MCP integration. Controlled tests across 100+ organizations achieved an 85% success rate. This is not a lab curiosity—it's a commodity-grade exploit chain.
Core: The Architectural Gap
Let me be precise. The vulnerability is not a bug in the model. It is a combinatorial failure of two individually valid design decisions.
Decision 1: Sentry's DSN-based ingestion. The DSN is a public identifier, not a secret. Anybody can POST events to it. This is by design—it allows client-side error reporting without storing API keys on end-user devices. But it means any attacker can inject arbitrary content into the error stream.
Decision 2: AI agents trust tool output as canonical context. The agent has no mechanism to distinguish between a legitimate error description and an attacker-injected command. The markdown containing npm install malicious-package-xyz is treated as a repair instruction, not as untrusted data.
The intersection of these two decisions creates a gap the attacker can walk through. The agent cannot perform semantic-level separation of data and instructions because the model was never trained to treat tool outputs as potentially adversarial. This is a classic indirect prompt injection, amplified by the agent's ability to execute shell commands.
Tenet's agent-jackstop mitigation is a band-aid, not a cure. It adds network whitelists, command approval prompts, and subprocess credential isolation. These reduce the blast radius but do not change the fundamental architecture: the moment a tool's output enters the agent's context window, it can influence decisions. The model's internal reasoning has no concept of "this string came from an untrusted source."
Contrarian: The Blind Spot Is Trust, Not Permission
The industry's reflex is to add more permission controls—approve each command, sandbox the agent, rotate credentials. But the root cause is not insufficient permissioning; it is the inability of current AI agents to distinguish between data and instructions at the semantic level.
Consider this: the attack does not require any zero-day in the model. The model is executing exactly what it was asked to do—fix a bug. The problem is that the "bug description" is a weaponized payload. The model's compliance with the instruction is a feature, not a bug. The real vulnerability is that we have designed agents to trust their environment implicitly.
Sentry's response confirms this. They deployed a content filter targeting specific payload strings, but refused to change the DSN authentication model, calling it "technically untenable." This is a commercial decision disguised as a technical one. Fixing the ingestion endpoint would require breaking the existing client-side reporting flow, which is Sentry's core product. A content filter is cheap optics—it blocks known strings but does not prevent attackers from using simple obfuscation. The filter is an admission that the channel is an attack vector, but an unwillingness to address the root cause.
Furthermore, the 85% success rate is a spotlight on a controlled environment. In the real world, the attack requires the developer to actively ask the agent about a Sentry issue. This is a human-in-the-loop precondition. But the number of exposed DSNs (2,388) and the ease of injection (one HTTP POST) mean that a motivated attacker can pre-position payloads for thousands of organizations and wait for a developer to trigger the chain. The attack is not automated end-to-end, but it is highly scalable in the setup phase.
Takeaway: The Next Security Battleground Is Data Provenance
Agentjacking warns us that the next wave of AI security will not be about model alignment—it will be about data provenance. The question is: can we build agents that treat every piece of external context with suspicion? The MCP protocol needs a security extension: a trustworthiness label on each tool output, or a mandatory instruction hierarchy that prevents markdown from being interpreted as executable commands. Until then, every MCP-connected tool is a potential backdoor. Logic is binary; intent is often ambiguous. Your AI agent's greatest strength—its ability to act on context—is also its greatest liability.