Cases › security breach › LR-2026-0585

Agentjacking attack tricks AI coding agents into running malicious code

Confirmed Why: 2 independent outlets · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major

Reported 12 Jun 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: test: many third parties (a stated count of more than 100 confirmed cases across a Fortune 500 cloud enterprise, a hosting provider, software firms, startups and individual developers) had agents execute attacker code on their machines.

Tenet Security described Agentjacking, an attack in which a crafted error event submitted to Sentry through a public write-only DSN was returned by the Sentry MCP server to AI coding agents such as Claude Code and Cursor as trusted output. When a developer asked an agent to fix unresolved Sentry issues, the agent read a disguised Resolution section and ran attacker-controlled code with the developer's privileges. In Tenet's controlled campaign, the code probed environment variables and configuration files and returned scoped exposure metadata to a beacon server. Tenet reported more than 100 confirmed cases. Tenet disclosed the findings to Sentry on June 3, 2026; Sentry introduced a global content filter for a specific payload string but did not fix the ingestion design.

What happened

1 · What it was doingA developer asked a coding agent to fix unresolved Sentry issues, and the agent queried Sentry through MCP.

2 · What went wrongThe agent could not tell an attacker-injected error event from a real crash, so it followed the injected instructions.

3 · What it reached or didThe agent ran the attacker-controlled code with the developer's full privileges.

What was done

No source states an action or fix.

Risks

Hidden instructions hijack the agent
Primary50 incidents
Rising: 6 vs 2.8 a week

Data leaked or sent out
Also32 incidents

Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Infrastructure / target

Not effective Intrusion and endpoint detection

Control failure chain

L1 · Model Not stated in sourcesProvider not named

L2 · Harness Not stated in sourcesHarness not named

L3 · Application Not stated in sourcesDeployer not named

L4 · Infrastructure / target Not effectiveOrganisation hit

L1 · ModelProvider not namedModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Prompt-injection detection, Confirmation after untrusted input, Validation of tool inputs and outputs, Tool allow-list.

L3 · ApplicationDeployer not namedDeployer

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.

L4 · Infrastructure / targetOrganisation hit

Not effectiveIntrusion and endpoint detection“Endpoint detection, WAFs, IAM policies, and firewalls detect no obvious policy violations because the observable behavior matches a developer-approved tool running approved commands on a trusted observability platform.”CyberSecurityNews

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Tool allow-list	L2 Harness	Not stated in sources
Confirmation after untrusted input	L2 Harness	Not stated in sources
Outside content treated as data, not instructions	L2 Harness	Not stated in sources
Prompt-injection detection	L2 Harness	Not stated in sources
Validation of tool inputs and outputs	L2 Harness	Not stated in sources
Least-privilege access for the agent	L3 Application	Not stated in sources
Human approval for high-impact actions	L3 Application	Not stated in sources
Segmentation of agent components	L3 Application	Not stated in sources
Alerts on unusual tool use	L3 Application	Not stated in sources
Intrusion and endpoint detection	L4 Infrastructure / target	Not effective

Similar incidents

Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs2026-10-07

All cases of this kind ›

Evidence

Cause a permission, scope or wiring error

No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off, what was done.

Show the full account: 2 items from the primary sources

What happened, in order

2026-06-03 Tenet disclosed the findings to Sentry.

Not dated in the sources:

Sentry activated a global content filter that blocks a specific payload string.

Show every field, with its source and grade

The AI system

What it was allowed to do

developer's full privileges

C one secondary source states it

What it was for

fixing unresolved Sentry issues with an AI coding agent

C one secondary source states it

What happened

Earliest source we hold

2026-06-12

D inferred by us from the described behaviour, reason shown

Who caught it

an independent researcher or journalist

C one secondary source states it

Cause

a permission, scope or wiring error

C one secondary source states it

Cause in detail

Agent cannot distinguish injected error events from real ones, so it treats attacker content as trusted output

C one secondary source states it

Who caused it

an outside attacker

C one secondary source states it

Earlier warning signs

Tenet disclosed its findings to Sentry on June 3, 2026

C one secondary source states it

What went wrong

security breach

C one secondary source states it

AI agent

an AI agent acted

C one secondary source states it

What it did

Agent reads attacker-crafted Sentry error content as trusted guidance and runs attacker-controlled code

C one secondary source states it

primary risk

RK01

D inferred by us from the described behaviour, reason shown

secondary risks

RK04, RK03

D inferred by us from the described behaviour, reason shown

control chain

layer: L4; party: target; control id: J4; outcome: failed; quote: Endpoint detection, WAFs, IAM policies, and firewalls detect no obvious policy violations because the observable behavior matches a developer-approved tool running approved commands on a trusted observability platform.; source index: 1

C one secondary source states it

Impact

Severity

major

D inferred by us from the described behaviour, reason shown

Kinds of data exposed

environment variables, Git credentials, private repository URLs, developer identities

C one secondary source states it

Why this severity

test: many third parties (a stated count of more than 100 confirmed cases across a Fortune 500 cloud enterprise, a hosting provider, software firms, startups and individual developers) had agents execute attacker code on their machines.

D inferred by us from the described behaviour, reason shown

Notes on gaps

Whether the cases were real victims or controlled test targets is not fully clear; sources describe a controlled campaign. Control statuses are inferred from the sources' descriptions.

LR-2026-0585 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON