Agentjacking: The Unspoken Architecture Debt of AI Agents

The numbers say 2,388 organizations exposed Sentry DSNs publicly. That is not a vulnerability. That is a statistic. But when you combine an unauthenticated error ingestion endpoint, a Model Context Protocol (MCP) integration, and an AI coding agent that trusts any data a tool returns, you get a six-step attack chain that works 85% of the time in controlled tests. I do not predict the future. I verify the past. And the past here is a DEF CON 34 presentation by Tenet Security that maps out exactly how an attacker can turn a developer's debugging session into a credential exfiltration event. Context: The mechanics are simple. Sentry's DSN (Data Source Name) is a public token that allows any client to send error events to a specific project. No authentication required for the POST endpoint. It is designed for openness. The MCP standard lets AI agents query external tools like Sentry to fetch issues, logs, and traces. Cursor and Claude Code both use MCP to pull Sentry issues for real-time debugging. The combination is a feature. The intersection is a flaw. Core: The attack chain is a closed loop of four decisions. First, the attacker scans public code repositories, npm packages, and documentation for exposed Sentry DSNs. Second, the attacker sends a crafted error event to that DSN containing a malicious payload disguised as a markdown code block. The third step requires a developer to trigger their AI agent to fetch issues from that Sentry project. The agent reads the markdown, interprets it as a suggested fix, and executes the command. The fourth step: the command installs an npm package that exfiltrates environment variables, AWS keys, GitHub tokens, and Docker registry credentials. The math does not weep. It merely liquidates. I have audited smart contracts for years. I know a reentrancy guard when I see one. But this attack has no reentrancy. It has a trust boundary. The root cause is architectural: the current generation of AI agents cannot distinguish between data and instruction. When an MCP tool returns a string, the agent treats it as context. If that string contains a shell command, the agent may execute it. Sentry's response was a content filter targeting specific payload strings. That is a bandage. A blacklist can be bypassed with a simple encoding change. Tenet's own agent-jackstop tool adds network egress whitelists, command approval, and subprocess credential isolation. But these are explosion radius controls, not root cause fixes. The MCP protocol itself lacks a mechanism to mark tool outputs as untrusted or to require explicit user confirmation for all code execution. The architecture is the problem. Contrarian: The 85% success rate is a headline. It is also a red flag. That number comes from a controlled test across 100+ organizations. But the attack requires a specific user action: the developer must ask the agent to debug a Sentry issue. If the developer never asks, the attack never triggers. The attack is not a worm. It is a fishing rod. The attacker casts the line (the malicious event), but the fish must bite. The real question is not whether the attack works 85% of the time in a lab, but whether the average developer in a high-tempo sprint will ask their agent to "fix this Sentry error" without inspecting the suggestion. Based on my experience watching developers use AI coding tools, the answer is yes. The urgency of a production error beats the caution of a security review. The contrarian angle is that this attack is not a model vulnerability. It is a workflow vulnerability. The data is the vector. The trust is the fault. Takeaway: The next signal to watch is Sentry's response timeline. If they do not implement a platform-level fix—such as signed envelopes, DSN rotation, or per-project IP whitelisting—within six months, the market will shift. Enterprise teams will start running self-hosted error monitoring with an MCP gateway that sanitizes all tool outputs. The math does not weep, but it also does not wait. Liquidity is not a promise. It is a state of flow. And right now, the flow of trust in AI coding agents is about to be dammed by a single HTTP POST.