On June 17, 2026, Tenet Security’s Threat Labs disclosed a new attack class termed “Agentjacking.” The vulnerability allows an attacker to hijack AI coding agents, forcing them to execute arbitrary code on a developer’s local machine. The attack exploits a fundamental design choice in the Model Context Protocol (MCP), where the trust architecture treats external data sources as trusted system output. As Tenet Security summarized, “Your telemetry is now an RCE vector.”
The mechanism relies on the ubiquity of public Sentry Data Source Names (DSNs), which are frequently embedded in frontend JavaScript code. An attacker can POST a crafted error event to a Sentry ingest endpoint using this public DSN. Within this event, the attacker embeds a malicious instruction disguised as a “Resolution” section. Because this section is formatted as markdown, it is visually indistinguishable from legitimate remediation guidance provided by Sentry.
When a developer prompts an AI agent to investigate errors, the agent uses MCP to query Sentry. The agent retrieves the injected event and interprets the attacker’s markdown-formatted command as authoritative diagnostic guidance. Consequently, the agent executes the command with the developer’s full system privileges. This allows for the exfiltration of environment variables, AWS keys, GitHub tokens, and git credentials, or the installation of malicious npm packages.
Tenet’s controlled testing demonstrated an 85% exploitation success rate against Claude Code. Across various validation waves, more than 100 agents acted on injected errors. Passive reconnaissance identified 2,388 organizations with valid, injectable DSNs, including 71 within the Tranco top-1M. Tenet confirmed agent execution at organizations including a Fortune 100 technology company valued at $250 billion. The exposure spans finance, healthcare, government, education, and critical infrastructure across more than 30 countries.
The attack bypasses traditional security controls, including EDR, WAF, IAM, VPNs, and firewalls. Tenet describes this as an “Authorized Intent Chain,” where every action in the sequence is technically authorized by the user’s own agent. Prompt-layer defenses have proven ineffective. As Tenet noted:
Prompt-layer defenses failed. Agents executed the payload even when explicitly instructed — through detailed system prompts and skills — to ignore untrusted data. You cannot fix this with a better prompt.
Tenet disclosed the issue to Sentry on June 3, 2026. According to Tenet’s account, Sentry leadership acknowledged the findings the same day but declined to implement a root-cause fix, characterizing the issue as “technically not defensible.” Sentry did activate a global content filter to block a specific payload string during the research period — detecting the activity without addressing the cause.
The vulnerability is not specific to Sentry but is inherent to the MCP design. Any MCP tool integration that returns externally-influenced data to an AI agent creates the same exposure. VentureBeat reported on June 15 that Datadog, PagerDuty, and Jira exhibit the same pattern. The Cloud Security Alliance (CSA) formally classified Agentjacking as a systemic MCP vulnerability class under its AI Safety Initiative on June 14. As Tenet Security emphasized:
The weakness is in how agents handle tool output, not a flaw in any single product.
Tenet has open-sourced “agent-jackstop,” drop-in hardening configurations for Cursor and Claude Code that mitigate the risk from untrusted telemetry ingestion. The configurations treat MCP-retrieved content as untrusted data and require human-in-the-loop approval before the agent executes commands sourced from external tools.
The core issue remains architectural. MCP’s trust model treats external data as system-level output, which means agents cannot distinguish between legitimate diagnostic guidance and injected instructions. Until that changes, the telemetry streams agents depend on will remain an attack surface.