{"schema_version":"0.8.0","id":"LR-2026-0136","record_version":3,"title":"Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":7.68,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-07","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":["code","file system","shell"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":"agentic_with_tools","intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-07","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Tenet Security demonstrated an 'Agentjacking' attack against a $250B Fortune 100 company, hijacking over 100 agents with an 85% success rate through injectable Sentry DSNs, a weakness it found across 2,388 organizations. Sentry acknowledged the disclosure on June 3, 2026 but declined to provide a root-cause fix. The account comes from an analysis piece published after the ngCERT GHOSTJACKING advisory of October 6, 2026.","tags":["prompt-injection","agent-security-hardening","governance-gap","shadow-ai"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: no cited fact meets a rung's test; the tier is inferred.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://forkast.news/after-ghostjacking-what-agent-security-hardening-actually-requires/","publisher":"news search (Google News index)","date":"2026-10-07","type":"press","title":"After GHOSTJACKING: What Agent Security Hardening Actually Requires","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.tools_granted":"C","system.integration_type":"D","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.agent_involved":"C","event.trigger":"C","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.detection_method":"D","impact.severity":"D","context.systemic_exposure":"C","context.shared_model_id":"C","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"system.tools_granted":[{"source_index":0,"quote":"It also mandates treating tool output as untrusted, implementing short-lived scoped credentials, segmenting agent execution, and disabling autonomous code, file system, or shell access by default."}],"system.integration_type":[{"source_index":0,"quote":"Eighty-eight percent of IT leaders report at least one security breach involving AI agents in the last 12 months, according to the AvePoint State of AI 2026 report."}],"event.trigger":[{"source_index":0,"quote":"The urgency for hardening is underscored by the reality of prompt injection."}],"event.tags":[{"source_index":0,"quote":"The urgency for hardening is underscored by the reality of prompt injection."},{"source_index":0,"quote":"This inertia is a governance failure, not a technical one."},{"source_index":0,"quote":"Additionally, 54% of organizations report having between 1 and 100 unsanctioned agents, creating a shadow AI problem that complicates any attempt at centralized security."}],"event.incident_class":[{"source_index":0,"quote":"The urgency for hardening is underscored by the reality of prompt injection."},{"source_index":0,"quote":"As noted in the OWASP Top 10 for Agentic Applications 2026, Agent Goal Hijack (ASI01) is the number one risk."}],"event.agent_involved":[{"source_index":0,"quote":"Eighty-eight percent of IT leaders report at least one security breach involving AI agents in the last 12 months, according to the AvePoint State of AI 2026 report."}],"context.systemic_exposure":[{"source_index":0,"quote":"When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations."}],"context.shared_model_id":[{"source_index":0,"quote":"When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations."}],"impact.severity":[{"source_index":0,"quote":"When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-07"}],"event.summary":[{"source_index":0,"quote":"When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations."},{"source_index":0,"quote":"Sentry acknowledged the disclosure on June 3, 2026, but declined to provide a root-cause fix, labeling the issue as technically not defensible."},{"source_index":0,"quote":"The ngCERT GHOSTJACKING advisory, released October 6, 2026, attempts to break this cycle by shifting the focus from detection to structural prevention."}]},"notes_on_gaps":"No source states the model name, version, developer, harness, permissions scope, autonomy level, guardrails present, deployment context, lifecycle stage, intended use, safeguard state, production intent, date occurred, failure class, detection method, root cause, responsible party, adversarial actor, input provenance, operations paused, remediation, precursor events, direct loss, records exposed, third-party count, affected description, protected class, data categories, reversibility, downstream exposure, industry, org size, country, denominator, upstream incident id, evidence integrity, regulatory or coverage details. event.trigger is prompt_injection because source 0 states prompt injection as the mechanism; no source rules out an external cause, so spontaneous is not used. event.incident_class is security_compromise because source 0 states prompt injection and agent goal hijack caused the action. system.integration_type is classified agentic_with_tools from the statement that AI agents were breached. context.shared_model_id is the injectable Sentry DSN named as the shared vulnerable component. No loss figure is stated, so severity is null. system.tier: not set; no operator named and deployment_context is not a lab's. impact.severity: carried from record_version 1; no stored answer supports a value. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-07] system.integration_type: agentic_with_tools. system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.detection_method: no source says who first noticed. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; summary or story described a different event or the article, not this event]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":true,"shared_model_id":"Sentry DSN","upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The article does not describe a single system's task; it discusses enterprise AI agents generally, including agents built on Cursor and Claude Code, and notes that only 5% of organizations use a single agentic platform while 43% rely on four or more.","quote":"Consider the adoption of agent-jackstop, a set of drop-in configurations for Cursor and Claude Code released by Tenet Security in June 2026.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The article reports that AI agents are being breached through prompt injection and agent goal hijack, and that organizations fail to apply available hardening such as deny-by-default egress, human-in-the-loop approval and least-privilege MCP servers.","quote":"The urgency for hardening is underscored by the reality of prompt injection.","source_index":0,"grade":"C"},{"step":"reached","text":"The article cites a Tenet Security demonstration against a $250B Fortune 100 company in which over 100 agents were hijacked with an 85% success rate, and injectable Sentry DSNs across 2,388 organizations were highlighted as vulnerable.","quote":"When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations.","source_index":0,"grade":"C"},{"step":"caught","text":"The article does not say who first noticed any incident; it reports that Sentry acknowledged the disclosure on June 3, 2026, which is a notification rather than detection.","quote":"Sentry acknowledged the disclosure on June 3, 2026, but declined to provide a root-cause fix, labeling the issue as technically not defensible.","source_index":0,"grade":"C"},{"step":"done","text":"The article says Sentry declined to provide a root-cause fix, and that the ngCERT advisory formalizes nine hardening steps including deny-by-default network egress, human-in-the-loop approval, least-privilege MCP servers, short-lived scoped credentials and disabling autonomous code, file system or shell access by default.","quote":"Sentry acknowledged the disclosure on June 3, 2026, but declined to provide a root-cause fix, labeling the issue as technically not defensible.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-07","source_urls":["https://forkast.news/after-ghostjacking-what-agent-security-hardening-actually-requires/"]}}