The crowd sees a moon; I see a model. At DEF CON 34, a presentation quietly dropped a payload that most will misread as just another prompt injection story. But the truth beneath the markdown is structural. A team from Tenet Security demonstrated something I have been modeling since 2020: the convergence of trustless infrastructure and trust-maximizing AI agents creates a vulnerability class that cannot be patched—only redesigned.
Hook
The attack chain is elegant in its minimalism. First, scrape public Sentry DSNs—2,388 organizations exposed, including 71 in the Tranco top 1 million. Then POST a malicious error event with a crafted markdown payload. The developer, debugging a production issue, asks their AI coding agent (Claude Code, Cursor) to check Sentry. The MCP bridge fetches the error. The agent interprets the markdown as a fix instruction, runs npm install, and exfiltrates AWS keys, GitHub tokens, and Docker registry credentials. No exploit. No zero-day. Just a logical gap in the architecture of digital trust.
Context
To understand why this matters, you have to see the layers. Sentry’s ingestion endpoint is open by design—anyone with a DSN can push events. That’s intentional for error logging. The MCP protocol, pushed by Anthropic, lets agents query external tools like Sentry, Jira, or databases. The AI model treats tool output as context, not as untrusted data. These are not bugs. They are design decisions that, when combined, create a perfect supply chain vector. The attack was independently reproduced in controlled tests with 85% success across 100+ organizations.
This is not a theory. This is a live, scalable attack surface that has been sitting in plain sight since the first MCP integration shipped.
Core
The core insight is not about prompt injection. It is about the absence of a semantic trust boundary. In traditional programming, input validation is a first-class concern. In AI agent architectures, the model treats every piece of context as a potential instruction. The fundamental invariant is broken: there is no mechanism for the agent to distinguish between “data about an error” and “instructions to fix the error.”
I have seen this pattern before. In 2017, I audited Golem’s tokenomics and found a similar flaw: the reward distribution mechanism treated transaction fees as static inputs, ignoring volatility. The result was a system that looked robust on paper but collapsed under real market dynamics. Here, the dynamic is analogous. The MCP protocol defines how to connect, but not how to authenticate content. The model has no “instruction hierarchy” that says: tool output is data, not code.
Sentry’s response—deploying a content filter for specific payload strings—is the equivalent of a blacklist in a world that needs a whitelist. It can be bypassed by base64 encoding, Unicode normalization, or simple rephrasing. The underlying vulnerability remains: the ingestion endpoint is still open, the MCP bridge still trusts the output, and the model still cannot reason about the provenance of the context.
Contrarian
Here is the contrarian view: the real opportunity is not in fixing Sentry, but in building a new trust layer for agent-data interactions. The crypto-native mindset—where verification is baked into every message—offers a blueprint. Imagine a system where every tool output carries a cryptographic signature and a “trustworthiness score” derived from the source’s reputation. The agent would not act on instructions unless they satisfy a policy: signed by a known sender, within a confidence threshold, and explicitly marked as executable.
This is exactly the kind of invariant I look for. The market is still focused on the attack, but the narrative shift is already happening: from “how do we stop prompt injection” to “how do we design agent ecosystems that are trustless by default.” The tools like agent-jackstop from Tenet are stopgaps. The real solution requires protocol-level changes to MCP, and possibly a new class of “agent gateways” that sit between the model and the external world, applying access control, content sanitization, and provenance verification.
Narratives are liquid; truth is solid. The truth is that every organization with an AI coding agent and a public DSN is at risk. But the solid takeaway is that this is not a bug in Sentry or MCP. It is a bug in our collective assumption that AI agents can be trusted to interpret context without structural safeguards.
Takeaway
Quietly positioned while the world shouts about prompt injection. The next narrative is not about new attacks, but about new infrastructure. I am watching for teams that build trust-minimized agent frameworks—the ones that incorporate cryptographic signatures, policy engines, and data provenance directly into the agent runtime. The market will eventually realize that the cost of not having this layer is far higher than the cost of building it.
Coding the future, one block at a time. The block after this one will be a trust layer for AI agents. And it will look more like a blockchain than a firewall.