Threat · curated 28 Jun 2026
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
First reported tenetsecurity.ai
Coverage timeline
Why it matters
The Sentry MCP agentjacking technique shows that any untrusted data an AI coding agent pulls through an MCP integration — here, error reports reachable with a leaked public key — can become a prompt-injection channel that hijacks the agent inside developer environments.
Researchers at Tenet Security describe "agentjacking," an attack in which a publicly exposed Sentry key lets an attacker inject fake error messages that AI coding agents such as Claude Code, Cursor, and Codex ingest via the Sentry MCP server. The crafted error content acts as an indirect prompt injection, hijacking the agent to execute attacker-directed actions; the team also published a mitigation tool, agent-jackstop, on GitHub.