TLDR Tech / InfoSec
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
Agentjacking is an attack where a publicly exposed Sentry DSN, a write-only credential that Sentry documents as safe to embed in frontend JavaScript, lets an attacker post a crafted error event whose markdown context fields render as a fake resolution section containing an npx command. When a developer asks an agent to clear the Sentry backlog, the agent pulls the injected event through MCP, reads the fabricated fix as trusted guidance, and runs the command with the developer's own privileges to reach AWS keys, GitHub tokens, and git credentials. The payload executes even when system prompts and skills instructed the agents to ignore untrusted data, and because every step is authorized, Tenet's "Authorized Intent Chain" sidesteps EDR, WAF, IAM, VPN, and firewall controls entirely. DSNs surface through Censys queries and GitHub code search, so defenders should treat every MCP integration like a vetted third-party dependency and gate agent-initiated commands at the runtime layer rather than relying on prompt-layer or network defenses.
Read the full story