{"schema_version":"0.10.0","id":"LR-2026-0585","record_version":1,"title":"Agentjacking attack tricks AI coding agents into running malicious code","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":55.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":6.4,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"46a54c4aaf0e20623bcefca660b45b43910b122e5f29186f704d8bc867593b74"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":"developer's full privileges","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"fixing unresolved Sentry issues with an AI coding agent","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-12","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Tenet Security described Agentjacking, an attack in which a crafted error event submitted to Sentry through a public write-only DSN was returned by the Sentry MCP server to AI coding agents such as Claude Code and Cursor as trusted output. When a developer asked an agent to fix unresolved Sentry issues, the agent read a disguised Resolution section and ran attacker-controlled code with the developer's privileges. In Tenet's controlled campaign, the code probed environment variables and configuration files and returned scoped exposure metadata to a beacon server. Tenet reported more than 100 confirmed cases. Tenet disclosed the findings to Sentry on June 3, 2026; Sentry introduced a global content filter for a specific payload string but did not fix the ingestion design.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"integration","root_cause_detail":"Agent cannot distinguish injected error events from real ones, so it treats attacker content as trusted output","failure_class_detail":"Agent reads attacker-crafted Sentry error content as trusted guidance and runs attacker-controlled code","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"Tenet disclosed its findings to Sentry on June 3, 2026","primary_risk":"RK01","secondary_risks":["RK04","RK03"],"control_chain":[{"layer":"L4","party":"target","party_name":null,"control_id":"J4","outcome":"failed","reason":null,"quote":"Endpoint detection, WAFs, IAM policies, and firewalls detect no obvious policy violations because the observable behavior matches a developer-approved tool running approved commands on a trusted observability platform.","source_index":1,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test: many third parties (a stated count of more than 100 confirmed cases across a Fortune 500 cloud enterprise, a hosting provider, software firms, startups and individual developers) had agents execute attacker code on their machines.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["environment variables","Git credentials","private repository URLs","developer identities"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html","publisher":"The Hacker News","date":"2026-06-12","type":"press","title":"Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cybersecuritynews.com/agentjacking-attack-hijacks-ai-coding-agent/","publisher":"CyberSecurityNews","date":"2026-06-13","type":"press","title":"New Agentjacking Attack Hijacks Your AI Coding Agent to Run Code From a Hacker's Server - CyberSecurityNews","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","system.permissions_scope":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.failure_class_detail":"C","event.detection_method":"C","event.root_cause":"C","event.root_cause_detail":"C","event.adversarial_actor":"C","event.precursor_events":"C","impact.data_categories_exposed":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"When a developer asks their AI coding agent to \"fix unresolved Sentry issues\" (or a similar prompt), the agent queries Sentry via MCP and receives the malicious event."}],"system.permissions_scope":[{"source_index":0,"quote":"The agent executes malicious code, which runs with the developer's full privileges."}],"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines."}],"event.agent_involved":[{"source_index":0,"quote":"The idea is to inject crafted input into Sentry error events, which are then interpreted by coding agents like Claude Code and Cursor as legitimate diagnostic resolution steps and run attacker-controlled code."}],"event.failure_class":[{"source_index":0,"quote":"The idea is to inject crafted input into Sentry error events, which are then interpreted by coding agents like Claude Code and Cursor as legitimate diagnostic resolution steps and run attacker-controlled code."}],"event.failure_class_detail":[{"source_index":0,"quote":"The idea is to inject crafted input into Sentry error events, which are then interpreted by coding agents like Claude Code and Cursor as legitimate diagnostic resolution steps and run attacker-controlled code."}],"event.detection_method":[{"source_index":0,"quote":"Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines."}],"event.root_cause":[{"source_index":0,"quote":"The problem is rooted in the implicit trust associated with connecting to external services using Model Context Protocol (MCP)."}],"event.root_cause_detail":[{"source_index":0,"quote":"Because an AI agent is unable to distinguish between an error event generated by a real application crash or injected by an attacker, it creates a pathway to arbitrary code execution when the agent processes the response."}],"event.adversarial_actor":[{"source_index":0,"quote":"An attacker finds a target's Sentry Data Source Name (DSN), a public, write-only credential that's embedded in websites."}],"event.precursor_events":[{"source_index":1,"quote":"Tenet disclosed its findings to Sentry on June 3, 2026; Sentry acknowledged the issue and introduced a global content filter for a specific payload string."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"A successful attack of this kind can expose sensitive data, including environment variables, Git credentials, private repository URLs, and developer identities, without having to rely on methods like phishing or prior server compromise."}],"impact.severity":[{"source_index":1,"quote":"Tenet reports more than 100 confirmed cases of real-agent execution across a Fortune 500 cloud enterprise, a multi-billion-dollar hosting provider, scientific software firms, startups, and individual developers."}],"impact.severity_because":[{"source_index":1,"quote":"Tenet reports more than 100 confirmed cases of real-agent execution across a Fortune 500 cloud enterprise, a multi-billion-dollar hosting provider, scientific software firms, startups, and individual developers."}],"event.control_chain":[{"source_index":1,"quote":"Endpoint detection, WAFs, IAM policies, and firewalls detect no obvious policy violations because the observable behavior matches a developer-approved tool running approved commands on a trusted observability platform."}],"event.summary":[{"source_index":0,"quote":"The injected event contains \"carefully formatted markdown\" in the message field and context key names."},{"source_index":0,"quote":"The agent executes malicious code, which runs with the developer's full privileges."},{"source_index":1,"quote":"In their controlled campaign, this package confirmed the presence of sensitive material by probing environment variables, checking the sizes of configuration files such as ~/.aws/config and ~/.docker/config.json, and inspecting network interfaces."},{"source_index":1,"quote":"Tenet reports more than 100 confirmed cases of real-agent execution across a Fortune 500 cloud enterprise, a multi-billion-dollar hosting provider, scientific software firms, startups, and individual developers."},{"source_index":1,"quote":"Tenet disclosed its findings to Sentry on June 3, 2026; Sentry acknowledged the issue and introduced a global content filter for a specific payload string."},{"source_index":0,"quote":"Sentry, for its part, has acknowledged the issue, but opted not to fix it, stating it's \"technically not defensible.\""}]},"notes_on_gaps":"No date of occurrence or date of detection is stated; 2026-06-03 is the date Tenet disclosed to Sentry, used as date_disclosed (judgement). The 100+ cases come from a vendor-affiliated research campaign (Tenet) reported by press, not an independent evaluator; the count is stated only as more than 100, so no exact count is recorded. Whether the cases were real victims or controlled test targets is not fully clear; sources describe a controlled campaign. Exposure of data is described as possible ('can expose'), not confirmed. The model names, versions, developer, autonomy level, tools granted and guardrails are not stated. Country and direct loss are not stated. Severity major is a judgement based on the stated count of third parties. Control statuses are inferred from the sources' descriptions. Sentry's filter is mapped to C2 as a judgement. Tags are a judgement from the source's wording. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A developer asked a coding agent to fix unresolved Sentry issues, and the agent queried Sentry through MCP.","quote":"When a developer asks their AI coding agent to \"fix unresolved Sentry issues\" (or a similar prompt), the agent queries Sentry via MCP and receives the malicious event.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The agent could not tell an attacker-injected error event from a real crash, so it followed the injected instructions.","quote":"Because an AI agent is unable to distinguish between an error event generated by a real application crash or injected by an attacker, it creates a pathway to arbitrary code execution when the agent processes the response.","source_index":0,"grade":"C"},{"step":"reached","text":"The agent ran the attacker-controlled code with the developer's full privileges.","quote":"The agent executes malicious code, which runs with the developer's full privileges.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html","https://cybersecuritynews.com/agentjacking-attack-hijacks-ai-coding-agent/"]},"analysis":{"sections":{"timeline":[{"text":"Tenet disclosed the findings to Sentry.","quote":"Tenet disclosed its findings to Sentry on June 3, 2026; Sentry acknowledged the issue and introduced a global content filter for a specific payload string.","source_index":1,"when":"2026-06-03"},{"text":"Sentry activated a global content filter that blocks a specific payload string.","quote":"However, the company is said to have activated a global content filter that blocks a \"specific payload string.\"","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html","https://cybersecuritynews.com/agentjacking-attack-hijacks-ai-coding-agent/"]}}