Threat
Agentjacking: A Fake Sentry Error Became a 'Fix' That Claude Code and Cursor Ran
Publication date unknown · Discovered dev.to
Page published
Publication date unknown · First observed: 10 Nov 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Agentjacking turns attacker-writable error telemetry into shell-execution instructions, exposing a trust-boundary failure that defenders should address by treating MCP-returned content as untrusted and constraining agent command execution.
Agentjacking, described by Tenet Security, uses public Sentry DSNs to plant error events containing a fake Resolution section that steers coding agents into running an attacker-supplied npx command through Sentry MCP responses. The article reports an 85% success rate in controlled testing involving more than 100 organizations, with Claude Code, Cursor, and Codex acting on planted errors.