Fake bug reports can hijack AI agents
Tenet Security showed how a fake error report can make AI coding agents like Claude Code and Cursor run attacker code; it found 2,388 exposed orgs.
Security firm Tenet Security detailed an attack it calls agentjacking, where a single fake error report makes an AI coding agent run an attacker’s code on a developer’s machine. In tests across more than 100 organizations, it worked about 85% of the time against agents including Claude Code and Cursor. During a scan that ended June 17, Tenet found 2,388 organizations carrying the exposed credential the attack needs.
The trick rides on Sentry, the error-tracking tool many teams already use. A Sentry project’s write key, called the DSN, is often left sitting in public website code. An attacker uses it to send a crafted error event with instructions hidden in markdown, dressed up as a “Resolution.” When you ask your agent to look into the error through Sentry’s Model Context Protocol connection, it reads those instructions as guidance and follows them, running commands with your full access. Tenet’s researchers note the payload arrives looking like a legitimate fix, and every step stays inside normal, authorized workflows, so firewalls, EDR, and the rest never register an attack.
Why this matters
Prompt injection through the tools an agent reads is no longer theoretical for coding work. Sentry called the issue “technically not defensible” and added a filter for one known payload, which is a patch, not a cure. The durable fix sits on your side: limit which tools and data sources your agent can reach, treat anything it reads from them as untrusted, and keep a person approving any action it takes. Tenet also released drop-in hardening configs for Cursor and Claude Code. The wider lesson echoes the Copilot data-theft flaw: a model still cannot tell your instructions from instructions buried in the text it reads for you.