Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
14:04 · June 12, 2026 · Hacker News AI Section
Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines. Called Agentjacking by Tenet Security, the attack can be triggered by means of a fake error report crafted using Sentry, an open-source error-tracking and performance-monitoring platform. "The attack
Summary
Cybersecurity researchers at Tenet Security have identified a new attack class, termed Agentjacking, that allows adversaries to induce AI coding agents into executing arbitrary commands on developer workstations. The technique relies on Sentry, the open-source error-tracking platform, as the delivery channel. By submitting a crafted error event through a publicly known Data Source Name, an attacker can embed malicious instructions that later appear as legitimate diagnostic guidance when the agent queries the Sentry MCP server.
The attack succeeds because AI agents such as Claude Code and Cursor treat data returned from connected external services as trusted context. When a developer asks the agent to investigate or resolve a Sentry-reported issue, the model interprets the injected “Resolution” field as authoritative advice and runs the embedded commands under the developer’s own privileges. No direct access to the victim’s infrastructure is required; the malicious payload travels through the same error-reporting pathway that organizations already expose for legitimate monitoring.
Successful exploitation can surface environment variables, Git credentials, private repository locations, and developer identities. Tenet Security reported discovering at least 2,388 organizations with injectable DSNs and achieved an 85 percent success rate when testing the technique against more than 100 targets using widely deployed coding assistants. Sentry has acknowledged the underlying design tension between open event ingestion and downstream agent consumption but has declined a structural fix, citing technical constraints, and has instead deployed a narrow content filter for one known payload string.
The finding underscores how the integration of AI agents with external data sources expands the attack surface beyond conventional network defenses. Because every step in the chain appears as authorized activity initiated by the developer, existing controls such as endpoint detection or web-application firewalls offer limited visibility.
Why it matters
Directly addresses AI security risks and vulnerabilities with actionable insights for professionals defending AI coding workflows in the Netherlands and EU.
