'Agentjacking' Exposes a Dangerous Trust Gap in AI Coding Tools, Hitting 2,388 Organisations With an 85% Exploitation Rate

In June 2026, cybersecurity researchers at Tenet Security disclosed a new class of attack they call 'Agentjacking,' which exploits the way AI coding agents process error reports from Sentry, a widely used open-source error-tracking and performance-monitoring platform. As The Hacker News reported on June 12, the attack tricks AI coding agents — including Claude Code, Cursor, and OpenAI Codex — into running arbitrary code on a developer's machine. The technique requires no stolen passwords, no malware, and no prior access to the target organisation's systems. Tenet researchers Ron Bobrov, Barak Sternberg, and Nevo Poran published the full research, demonstrating how attackers can send a crafted error event to Sentry using a publicly accessible Data Source Name, embedding commands that the AI agent interprets and executes as legitimate diagnostic guidance.

The scale of the vulnerability is alarming. According to Tenet's research, the attack achieved an 85 percent exploitation rate across tested environments, and during a validation period ending June 17, 2026, the researchers identified 2,388 organisations with exposed Sentry Data Source Names. Infosecurity Magazine reported that the technique works by exploiting an architectural flaw: Sentry's DSN is intentionally public, embedded in frontend JavaScript for error reporting purposes. When a developer asks an AI coding agent to help fix an error, the agent reads the injected instructions embedded in the fake Sentry report and executes the attacker's commands with the developer's own privileges on the developer's own machine. The Decryption Digest noted that endpoint detection and response tools, firewalls, and even prompt-level guardrails all failed to catch the attack during testing.

What makes Agentjacking particularly insidious is the trust dynamic it exploits. Developers have been trained over recent months to treat the output of AI coding agents as reliable. When Claude Code or Cursor issues an instruction, developers typically act on it — and that conditioned trust is precisely the attack surface Agentjacking targets. As Tenet documented, the attack can expose sensitive developer secrets, including AWS keys, GitHub tokens, and SSH keys, and a single compromised developer session provides lateral movement paths into cloud infrastructure, source code repositories, and CI/CD pipelines without triggering a single security alert. The research team confirmed successful agent execution affecting targets ranging from solo developers to at least one Fortune 500 enterprise, with victims seeing only benign diagnostic outputs throughout.

The institutional response has been troublingly inadequate. Tenet disclosed the findings to Sentry on June 3, 2026. Sentry acknowledged the vulnerability but declined to implement a root-cause fix, describing the attack class as 'technically not defensible' at the platform level, according to reporting by Cyberpress. The remediation Sentry deployed amounts to a content filter targeting one specific payload string from the proof of concept — a patch that Tenet itself described as trivially circumventable. The deeper problem, as cybersecurity analysts at aviatrix.ai noted, is architectural: current AI models cannot reliably distinguish descriptive data from embedded instructions, especially when those instructions appear in seemingly trusted logs, metrics, or error messages. Any Model Context Protocol integration that returns externally influenced data to agents carries a structurally similar risk.

The Agentjacking disclosure lands at a moment when enterprise adoption of AI coding agents has dramatically outpaced the development of applicable security controls. According to Y Combinator-backed startups in the agentic security space, chief information security officers have been loudly voicing a growing need for verifiable, fine-grained controls on complex multi-agent systems for months. For developers using AI coding tools today, security researchers recommend treating all error-tracking platform output as untrusted input before passing it to an AI agent — a mitigation that requires overriding habits developed through daily use of tools that have become core to modern software workflows. As the Semiconductor Industry Association-Deloitte study released June 1 estimated annual chip revenue from AI data centres could exceed $1.2 trillion by 2028, the Agentjacking episode is a timely reminder that the infrastructure securing the AI era is moving considerably more slowly than the infrastructure powering it.