Cases › security breach › LR-2026-0136
Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs
Severity major: no source gives a fact that decides the level; we set it from the description
Earliest source we hold 2026-10-07
Tenet Security demonstrated an 'Agentjacking' attack against a $250B Fortune 100 company, hijacking over 100 agents with an 85% success rate through injectable Sentry DSNs, a weakness it found across 2,388 organizations. Sentry acknowledged the disclosure on June 3, 2026 but declined to provide a root-cause fix. The account comes from an analysis piece published after the ngCERT GHOSTJACKING advisory of October 6, 2026.
Risk grouping: AI attacked
| Who caused it | A person or organisation “When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations.” source |
|---|---|
| Intended or not | Intended “When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations.” source |
| Before or after release | After release “When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations.” source |
| The AI's part | Attacked “When Tenet Security demonstrated Agentjacking against a $250B Fortune 100 company – hijacking over 100 agents with an 85% success rate – they highlighted the vulnerability of injectable Sentry DSNs across 2,388 organizations.” source |
The story
1 · What it was doingThe source discusses enterprise AI agents generally, including agents built on Cursor and Claude Code, and notes that only 5% of organizations use a single agentic platform while 43% rely on four or more.
2 · What went wrongThe source reports that AI agents are being breached through prompt injection and agent goal hijack, and that organizations fail to apply available hardening such as deny-by-default egress, human-in-the-loop approval and least-privilege MCP servers.
3 · What it reached or didThe source cites a Tenet Security demonstration against a $250B Fortune 100 company in which over 100 agents were hijacked with an 85% success rate, and injectable Sentry DSNs across 2,388 organizations were highlighted as vulnerable.
4 · How it was caughtThe source reports that Sentry acknowledged the disclosure on June 3, 2026, which is a notification rather than detection.
5 · What was doneThe source says Sentry declined to provide a root-cause fix, and that the ngCERT advisory formalizes nine hardening steps including deny-by-default network egress, human-in-the-loop approval, least-privilege MCP servers, short-lived scoped credentials and disabling autonomous code, file system or shell access by default.
What the sources state
- What set it off hidden instructions in its input
Show every field, with its source and grade
The AI system
Tools it was given
code, file system, shell
C one secondary source states it
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What happened
Earliest source we hold
2026-10-07
A the date the source itself carries
What set it off
hidden instructions in its input
C one secondary source states it
Themes
prompt injection, agent security hardening, governance gap, shadow AI
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Why this severity
no source gives a fact that decides the level; we set it from the description
D inferred by us from the described behaviour, reason shown
Context
Shared exposure
one shared model or part put many users at risk
C one secondary source states it
Shared model
Sentry DSN
C one secondary source states it
LR-2026-0136 · version 3 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON