Agentjacking at DEF CON 34: A Forensic Analysis of MCP-Based Credential Theft in AI Coding Agents
The 2,388 number is a baseline. Not a theoretical maximum. A single HTTP POST to a public Sentry DSN on a known domain can initiate a credential compromise chain. The attacker does not need to exploit a zero-day, bypass a firewall, or social engineer a victim. They only need to find a developer who uses an AI coding agent integrated with the Model Context Protocol (MCP) and who has ever exposed a Sentry DSN in a public repository. Controlled tests across 100+ organizations returned an 85% success rate for the full attack chain. Data does not negotiate; it only reveals. The data reveals a systemic failure in the architecture of AI agent trust boundaries.
This attack, presented at DEF CON 34 by Tenet Security under the name 'Agentjacking,' is not a novel cryptographic flaw. It is a combinatorial vulnerability: three independently legitimate design decisions, when stacked, create a high-probability exploit path. The first decision is Sentry's unauthenticated ingestion endpoint. Any HTTP POST containing a valid DSN and a payload is accepted as a crash report. No origin verification, no signature, no rate limiting tied to source identity. The second decision is the MCP integration in AI coding agents like Claude Code and Cursor. These agents, when given a debugging task, query Sentry via MCP to retrieve issues. The third decision is the agent's default trust in tool output. The returned data—error messages, stack traces, developer comments—is inserted directly into the agent's context window. The model does not have a mechanism to distinguish between a legitimate error description and an attacker-injected instruction.
The attack chain is discrete and verifiable. Step one: Reconnaissance. The attacker scans public repositories, npm packages, and exposed CI/CD logs for Sentry DSNs. The report identifies 2,388 organizations with publicly discoverable Sentry DSNs, 71 of which belong to domains in the Tranco top 1 million. Approximately 27% of Fortune 1000 companies are exposed via Cloudflare's MCP integration. These numbers are anchor points, not exact counts, but they establish the attack surface as real and measurable. Step two: Injection. The attacker crafts a malicious error event containing a markdown block that mimics a 'fix suggestion.' The payload includes a command to install a rogue npm package. The attacker sends this event via a POST request to the target's Sentry endpoint. No authentication is required. The DSN is the only key. Step three: Opportunity. The developer encounters a real or apparent error in their codebase. They ask the AI agent to debug. The agent, via MCP, fetches the latest Sentry issues. The malicious error event is returned. Step four: Execution. The agent reads the markdown content. The model interprets the 'fix suggestion' as a valid instruction. It generates the command to install the npm package. The developer, trusting the agent's output, executes the command. Step five: Compromise. The rogue npm package executes a post-install script that exfiltrates credentials from the developer's environment: AWS keys, GitHub OAuth tokens, GitLab tokens, npm registry tokens, Docker registry credentials. Step six: Post-exploitation. The attacker now has lateral access to the developer's cloud accounts, CI/CD pipelines, and package registries. The attack is complete.
The architecture flaw is the root cause. Current AI agent architectures cannot reliably separate 'data' from 'instruction' at the semantic level. When a tool output is ingested into the agent's context, it becomes part of the prompt. The model has no inherent bias to distrust tool outputs. This is a direct analogue to SQL injection, where user input is treated as executable code. In this case, tool output is treated as part of the reasoning narrative. The problem is not limited to Sentry or MCP. Any agent that consumes external data—APIs, databases, file systems, email—shares the same risk surface. The report explicitly states that the risk 'extends to any MCP-connected agent consuming external influence data.'
Sentry's response to the disclosure is instructive. On June 3, 2026 (the report's date, likely a typo for 2025), Sentry was notified. Their fix was a content filter deployed globally, targeting specific payload strings. This is a signature-based approach. It can be bypassed with simple obfuscation: Base64 encoding, character substitution, splitting the payload across multiple events. The filter does not address the root cause—the unauthenticated ingestion endpoint—nor does it provide a mechanism for agents to verify the authenticity of error events. Tenet Security's own mitigation, agent-jackstop, is a client-side hardening configuration. It includes network egress allowlists, command execution approval prompts, subprocess credential isolation, and treating all tool output as untrusted data. These are pragmatic steps that reduce the blast radius, but they do not change the architectural fact that once data enters the agent's context, it can influence decision-making.
Based on my experience auditing DeFi protocol integrations and tracing cross-chain attack vectors, this attack chain is structurally identical to a smart contract reentrancy exploit. The agent is the vulnerable contract. The tool output is the external call. The model's trust in that output is the unprotected state change. The fix requires a reentrancy guard at the protocol level: the MCP layer must enforce a data integrity boundary. The tool output should be tagged with a 'trustworthiness' flag, and the agent's reasoning engine should be trained to treat tool outputs as potentially adversarial. This is a model-level training problem, not just a configuration patch. Current production-grade coding agents do not solve this.
Behind the numbers, several hidden assumptions require scrutiny. The 85% success rate is based on controlled tests with developers who were asked to debug a Sentry issue. The report does not disclose the exact simulation conditions, the sophistication of the developer models, or the rate of human intervention that could break the chain. In a real-world scenario, a developer might inspect the npm package name, notice the domain mismatch, or run the command in a sandbox. The attack requires a specific human-machine collaboration: the developer must trust the agent and execute the command without verification. That is a plausible scenario, but it is not a guaranteed automatable exploit. The 2,388 organizations figure is a snapshot; many DSNs may be expired or belong to abandoned projects. The Fortune 1000 exposure via Cloudflare MCP is an inference, not a confirmed exploitation path.
Nevertheless, the contrarian view deserves attention. The bulls might argue that this is a known class of attack—indirect prompt injection—and that the industry has already seen similar demonstrations. They might point to the fact that the attack requires the developer to actively ask the agent to debug a Sentry issue, which is not a default workflow. They might also note that the mitigation tools are effective for the current attack surface. These arguments are valid but myopic. The significance of Agentjacking is not the novelty of the technique but the commoditization of the attack. The combination of public DSN scanning, automated payload injection, and MCP integration creates a scalable, low-cost supply chain weapon. The attack does not require a target to be running a vulnerable smart contract or a misconfigured Kubernetes cluster. It only requires a developer who uses a mainstream AI coding tool. That is the new reality.
The forward-looking implications are structural. First, AI coding agent adoption in enterprise environments will face a security review roadblock. Organizations that already mandate security gate reviews for third-party libraries will now require similar reviews for AI agent integrations. The MCP protocol will need to evolve a security extension layer, specifying how tool outputs should be sanitized, signed, and tagged with data provenance. Second, the error monitoring SaaS market—led by Sentry—will face pressure to offer authenticated ingestion, DSN rotation, and anomaly detection for event payloads. Third, a new security category will emerge: 'Agent Supply Chain Security.' This includes tools like agent-jackstop, but also MCP proxy gateways, agent behavior audit logs, and AI-specific credential vaults. Fourth, the compensation structure for security researchers will shift. Finding a single bug in a smart contract is valuable; finding a combinatorial attack chain that spans multiple platforms is systemically more valuable. The industry needs to reward this type of analysis.
One question remains unanswered. Why did Sentry choose a content filter over a platform-level authentication model? The report states that Sentry deemed the latter 'technically untenable.' That is a business decision, not a technical limitation. Adding authentication to the ingestion endpoint would require all existing clients to update their SDKs, and it would break backward compatibility with legacy integrations. The cost of changing the core product is high. The cost of a content filter is low. But the risk transfers to the customer. Every organization that uses Sentry with an AI coding agent now carries this residual risk. The insurance industry will eventually price this risk into cyber policies. The market will correct.
Data does not negotiate; it only reveals. The data from this analysis reveals that the AI agent ecosystem is running on a trust model designed for a pre-agent internet. The internet of tools and APIs assumed that the consumer of data is a human who can apply judgment. When the consumer is an AI agent that treats all text as equally authoritative, the trust model breaks. The Agentjacking attack is a symptom of that break. The fix is not a single content filter or a configuration script. The fix is a re-architecture of how agents consume external data. Until that happens, every developer who types 'fix this error' into their AI agent is taking a calculated risk. The calculation is now exposed.