Tenet Security’s DEF CON 34 presentation carried a blunt title: “Your WAF Blocked Us, That Was The Exploit — Remote Agent Takeover via Cloudflare, Sentry and Claude Zero-Day for data exfil.” On Sunday at LVCC Exhibit Hall West 3, CEO Barak Sternberg, CTO Nevo Poran, and researcher Ron Bobrov walked through how a publicly exposed Sentry Data Source Name and a Model Context Protocol integration chain into remote code execution on a developer’s machine — and how, in controlled testing across more than 100 organizations, the attack worked 85 percent of the time.
The attack surface is the intersection of two individually legitimate design decisions. Sentry’s error-tracking ingest endpoint accepts POST requests from anyone with a DSN — no authentication required — because that is how it works. AI coding agents like Claude Code and Cursor query Sentry through MCP integrations because that is how they debug. The gap between those two functions is the exploit.
Tenet’s research identified 2,388 organizations with publicly discoverable Sentry DSNs, including 71 in the Tranco top-1 million websites. Through Cloudflare MCP integration alone, approximately 27 percent of Fortune 1000 companies were exposed. The target credentials: AWS keys, GitHub and GitLab OAuth tokens, npm and Docker registry tokens, Kubernetes credentials, and CI/CD secrets.
The chain works in six stages. An attacker discovers a public DSN from JavaScript bundles, GitHub repositories, or scanning. They POST a crafted error event to Sentry’s ingest endpoint with malicious instructions embedded in the error message fields — formatted as markdown that reads like legitimate remediation guidance. When a developer asks their coding agent to debug Sentry issues, the agent retrieves the injected event through MCP, treats the markdown as authoritative diagnostic instructions, and executes the attacker’s commands with the developer’s local privileges. A single npm install pulls a malicious package; the package exfiltrates credentials.
Sentry was notified on June 3, 2026. The company deployed a global content filter targeting a specific payload string by June 12, but declined to implement platform-level root-cause remediation, characterizing such a change as “technically not defensible.” The disagreement is specific: Tenet argues the risk class extends to any MCP-connected agent consuming externally-influenced data, and a payload-string filter addresses one exploit formulation, not the vulnerability pattern.
On the agent side, Tenet released agent-jackstop, a set of drop-in hardening configurations for Cursor and Claude Code. The primary control is a deny-by-default network egress allowlist that blocks both the malicious package fetch and the exfiltration beacon. Additional layers require explicit approval before executing any command, block credential reads at the subprocess level for directories like ~/.aws and ~/.ssh, and instruct the agent to treat tool and log output as untrusted data. The configurations are available for both individual settings and MDM-deployed managed paths.
The tool has limits. It covers Cursor and Claude Code, not every MCP-connected agent. It reduces blast radius; it does not eliminate prompt injection. And it does not address the architectural problem the research identifies: once an agent’s MCP integration is active, every externally-influenced data source that agent consults becomes a potential injection point. Sentry DSNs are the demonstration. The vulnerability class is broader.
No CVE was assigned. This is not a patchable bug in a single vendor’s product — it is a structural failure in how AI agents distinguish data from instructions. Sentry’s position that the fix is “technically not defensible” at the platform level may be correct. But it leaves organizations with the same exposed attack surface the research documented, and individual hardening tools that cover a fraction of the installed agent base.