{"id":1288,"date":"2026-06-12T12:12:55","date_gmt":"2026-06-12T12:12:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1288"},"modified":"2026-06-12T12:12:55","modified_gmt":"2026-06-12T12:12:55","slug":"agentjacking-attack-tricks-ai-coding-agents-into-running-malicious-code","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1288","title":{"rendered":"Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 12, 2026<\/span><\/span>Artificial Intelligence \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines.<\/p>\n

Called Agentjacking<\/b> by Tenet Security, the attack can be triggered by means of a fake error report crafted using Sentry, an open-source error-tracking and performance-monitoring platform.<\/p>\n

\u00abThe attack exploits a critical architectural flaw at the intersection of Sentry’s event ingestion (which accepts arbitrary payloads from anyone with the DSN) and the Sentry MCP server (which returns this data to AI agents as trusted system output),\u00bb security researchers Ron Bobrov, Barak Sternberg, and Nevo Poran said<\/a>.<\/p>\n

The idea is to inject crafted input into Sentry error events, which are then interpreted by coding agents like Claude Code and Cursor as legitimate diagnostic resolution steps and run attacker-controlled code.<\/p>\n

A successful attack of this kind can expose sensitive data, including environment variables, Git credentials, private repository URLs, and developer identities, without having to rely on methods like phishing or prior server compromise.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The problem is rooted in the implicit trust associated with connecting to external services using Model Context Protocol (MCP). Because an AI agent is unable to distinguish between an error event generated by a real application crash or injected by an attacker, it creates a pathway to arbitrary code execution when the agent processes the response.<\/p>\n

<\/p>\n

The attack chain devised by Tenet is as follows –<\/p>\n