Threat · curated 19 Jul 2026
Agentjacking and MCP trust: are AI coding agents too easy to steer?
First reported swarmnetics.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Agentjacking shows that MCP-connected AI coding agents can be hijacked through ordinary telemetry channels, turning a public input path into a credential-stealing command channel unless provenance checks and secret scoping are enforced.
Agentjacking, described by Swarmnetics and Tenet Security, abuses trusted error-report inputs in AI coding agents: an attacker with a publicly exposed Sentry DSN can inject malicious instructions into telemetry that the agent processes, steering it to exfiltrate secrets such as cloud keys, Git credentials, and private repo URLs. The root flaw is that these systems treat source trust as if it equals action trust, letting external report text become executable guidance.
Summary
Researchers at Swarmnetics and Tenet Security describe 'agentjacking,' a technique that abuses trusted error-report inputs consumed by AI coding agents. An attacker who discovers a publicly exposed Sentry DSN can inject malicious instructions into error-report telemetry, which a connected AI coding agent then treats as actionable guidance, enabling theft of secrets.[0]
The reporting frames the root cause as a trust-provenance failure rather than poor hygiene: once external telemetry enters an agent workflow, the system conflates the trust of the report's source with authority to take action. According to the aggregator, the researchers consider the issue difficult to patch at either end of the workflow.[0]
Attack chain
- Reconnaissance: An attacker locates a publicly exposed Sentry DSN in public code, HTTP bodies, or third-party discovery services, giving them access to an identity-bearing input path.[0]
- Injection: The attacker submits crafted error-report telemetry through the Sentry MCP error-report path, embedding hidden malicious instructions within the report text.[0]
- Execution: A connected AI coding agent processes the external error report as trusted, executable guidance rather than read-only data, following the injected instructions.[0]
- Exfiltration: The poisoned instructions cause the agent to read and exfiltrate accessible secrets such as AWS keys, GitHub tokens, and repository URLs.[0]
How it works
The vulnerability is a broken trust boundary: AI coding agents connected via MCP ingest external error reports and treat report text as executable guidance instead of inert data, so hidden instructions carried in telemetry are acted upon by a privileged agent.[0]
A publicly exposed Sentry DSN turns a public input path into an identity-bearing channel, allowing an attacker to feed malicious content into the trusted Sentry MCP error-report path and reach the agent. Because the flaw is architectural (source trust treated as action trust), researchers describe it as difficult to patch at either end of the workflow.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| AI coding agents connected via the Sentry MCP error-report path | Products tested by Swarmnetics across multiple agent implementations; specific versions not stated in the available evidence | Researchers describe the issue as difficult to patch at either end of the workflow[0] |
Key takeaways
- Agentjacking is fundamentally a trust-provenance failure, not a mere prompt-injection curiosity: the defect lies in equating the trust of a data source with authority to act on it inside an agent workflow.[0]
- Exposed integration credentials like a Sentry DSN materially increase AI agent risk by turning a public input path into an identity-bearing channel that can steer privileged agents.[0]
- Defenses should focus on architectural separation of telemetry intake from action authority and on tightly scoping secrets accessible to coding agents, since the researchers consider the flaw hard to patch at either end.[0]
Defensive actions
- Separate report intake from action authority by routing external telemetry into a read-only ingestion layer.: Prevents the agent from treating error-report text as executable guidance, closing the trust-boundary gap that agentjacking exploits.[0]
- Inventory exposed integration credentials such as DSNs, tokens, and keys across public code, HTTP bodies, and third-party discovery services.: Exposed integration secrets convert a public input path into an identity-bearing channel that attackers use to influence trusted workflows.[0]
- Reduce the secrets and repository scopes available to AI coding agents.: Limiting secret reach ensures a poisoned instruction cannot exfiltrate cloud keys, Git credentials, or private repo URLs.[0]
- Place provenance checks, policy gates, and strict secret scoping between external inputs and agent actions.: Enforces separation of data provenance from action authority in MCP-connected workflows, reducing agentjacking risk.[0]