TL;DR: A new attack called Agentjacking uses fake Sentry error reports to trick AI coding agents into running arbitrary code. Combined with the PraisonAI authentication bypass exploited within hours of disclosure and Docker's documented coding agent horror stories, 2026 is shaping up as the year AI agents stop being a productivity dream and become a security nightmare. Here's what's happening and how to not get owned.
The Hook
Imagine this: you open your editor, type "fix the Sentry errors," and hit enter. Your AI coding agent dutifully queries Sentry via MCP, finds a stack trace, and runs what looks like a reasonable fix. Except that "error" was planted by someone who found your Sentry DSN in a public JavaScript bundle. And the "fix" just exfiltrated your SSH keys, your GitHub tokens, and your entire .env file.
No phishing email. No compromised server. No malware signature for your EDR to catch.
Just you, your trusted AI assistant, and a data breach you handed over on a silver platter.
This is Agentjacking. And it works 85% of the time.
What Is Agentjacking?
On June 12, 2026, security researchers at Tenet Security published a new attack class targeting the architectural blind spot where AI coding agents meet external data sources. The attack exploits a fundamental design flaw.
Here's the chain:
Attacker finds a Sentry DSN in a public website or JavaScript bundle. Sentry DSNs are public, write-only credentials. Anyone can send error events to them.
Attacker injects a malicious error event via a simple POST request. The event contains carefully formatted markdown in the message and context fields, designed to look exactly like Sentry's legitimate resolution guidance.
Developer asks their AI agent to fix Sentry issues. The agent queries Sentry via the Sentry MCP server, fetches the attacker's injected error, and cannot distinguish it from a real application crash.
Agent executes the attacker's payload. With the developer's full privileges. On the developer's machine.
The Hacker News reported that Tenet tested this against over 100 organizations and achieved an 85% success rate across the most widely used AI coding assistants, including Claude Code and Cursor. They also found at least 2,388 organizations with valid, injectable DSNs exposed.
Sentry acknowledged the issue but declined to patch it, stating it is "technically not defensible" in their architecture. They activated a global content filter that blocks a specific payload string, but that's a band-aid, not a fix.
This Is Not an Isolated Incident
If Agentjacking were just one clever attack against one error-tracking platform, it would be bad enough. But it is part of a pattern that should concern anyone who has granted an AI agent access to their development environment.
PraisonAI: Exploited Within 4 Hours
In May 2026, a critical authentication bypass was disclosed in PraisonAI, a popular multi-agent orchestration framework. CVE-2026-44338 affected versions 2.5.6 through 4.6.33, allowing unauthenticated attackers to hijack preconfigured multi-agent workflows, access model provider API keys, and abuse LLM quotas.
According to The Hacker News, threat researchers detected active scanning for vulnerable instances within 3 hours and 44 minutes of disclosure. Attackers didn't wait for a patch. They moved within the same business day.
Sysdig Threat Research documented active exploitation targeting exposed /agents endpoints, with attackers pivoting from scanning to credential extraction in automated exploitation loops. BrinzTech's threat lab tracked the entire scanning-exploitation loop -- and it was fully automated.
Docker's Coding Agent Horror Stories
Earlier this month, Docker published a series on AI coding agent horror stories, including the now-infamous "rm -rf ~/" incident where an agent, tasked with a cleanup operation, interpreted its instructions so literally that it deleted the developer's home directory. Docker argued that when agents operate outside sandboxed environments, any mistake -- or any malicious instruction -- becomes a catastrophic system event.
The AISI Data
The UK AI Security Institute published data in February 2026 showing that the length of cyber tasks AI models can complete autonomously has been doubling every 4.7 months. That is no longer theory. We are now in a world where frontier models autonomously complete multi-hour cyberattack chains against simulated enterprise networks. The AISI confirmed that both GPT-5.5 and newer checkpoints of Claude Mythos can complete full cyber ranges.
These models are being deployed as coding agents, given shell access, connected to MCP servers, and told to "fix things" -- on production infrastructure, with production credentials.
The Common Thread: Implicit Trust Is the Vulnerability
All of these incidents share the same root cause: implicit trust in agent outputs and inputs.
Agentjacking works because the Sentry MCP server returns attacker-controlled data to the agent without verification. The agent treats that data as trusted guidance because it came from an authorized MCP server. The developer trusts the agent because it has always worked before.
The PraisonAI vulnerability works because agents assume authenticated access is someone else's problem. The deployment exposes the agent API server without authentication, and the agent framework doesn't enforce that access controls exist.
Docker's horror stories happen because agents assume they are operating in a safe environment and the developer assumes the agent will check before deleting everything.
This is the security equivalent of handing your house keys to a stranger because they showed up wearing a uniform and carrying a clipboard. The uniform looks right. The clipboard looks right. But nobody checked the credentials behind them.
What Makes This Different From Other Attacks?
There are three things that make the current wave of agent attacks different from everything that came before:
1. The speed of exploitation. PraisonAI was exploited within 4 hours of disclosure. Not days. Not weeks. Hours. When your attack surface includes AI agents with shell access, the window between disclosure and compromise shrinks to a coffee break.
2. The bypass of traditional security. Agentjacking bypasses EDR, WAF, IAM, VPN, Cloudflare, and firewalls. There is nothing malicious to detect. Every action in the chain is authorized. The user asked the agent to fix an error. The agent read data from an authorized MCP server. The agent ran code on the developer's machine. Everything looks legitimate because, from the system's perspective, it is.
3. The compounding of privileges. An AI coding agent does not operate with the permissions of a web application. It operates with the permissions of a developer who has SSH keys, cloud console access, production database credentials, and Git push rights. When you compromise the agent, you bypass not just one system but the entire development toolchain.
How to Protect Yourself From Agentjacking?
While the industry works on better agent security frameworks, here is what you can do today:
Lock down your MCP servers. Do not connect MCP servers that return untrusted user data to your coding agents. If you use Sentry, consider whether your coding agents need direct MCP access to error tracking, or whether a human-in-the-loop review is better.
Run agents in sandboxed environments. Docker containers with read-only filesystems, network policies that restrict egress, and no access to production secrets. Docker's own AI Governance product is designed for exactly this.
Implement agent-level access controls. Agents should authenticate before accessing sensitive operations. This is the thesis behind APort, an open-source agent passport system that requires agents to present verifiable credentials before executing privileged actions. If your agent framework does not enforce authentication at the agent level, you are one DSN scan away from a breach.
Audit your exposed DSNs and API endpoints. Check your public JavaScript bundles for embedded DSNs. Run a scan on your deployed agent API endpoints to ensure authentication is enforced and the /agents endpoint is not publicly accessible.
Assume compromise and monitor agent behavior. Log every command your coding agent executes. Monitor for unusual patterns. Set up alerts for agents accessing production databases or modifying SSH configuration. An agent that suddenly starts reading /etc/shadow or running curl to unknown IPs is compromised.
What Needs to Change
The security industry needs to evolve its thinking about trust boundaries in AI-augmented development. The agent is now a privileged user of your system. It deserves the same security scrutiny you would give a new hire with production access.
Three specific changes:
MCP needs a security layer. The Model Context Protocol needs to support authentication, integrity verification, and origin validation. An agent should be able to verify that data returned from an MCP server has not been tampered with by an external party.
Agent frameworks need identity. Every agent execution should carry a verifiable identity that can be inspected by the tools and systems it accesses. If an agent cannot prove who authorized it, it should not be trusted with sensitive operations.
Developers need AgentSec training. Most developers understand SQL injection and XSS. Very few understand prompt injection, MCP poisoning, or agent-level auth bypass. We need the same shift that happened with DevSecOps: security awareness embedded into the developer workflow, not bolted on after the breach.
The Bottom Line
Agentjacking is not a vulnerability in Sentry. It is not a vulnerability in Claude Code or Cursor. It is an architectural vulnerability in the way we have designed the relationship between AI agents, external data sources, and the privileges we grant them.
The attack bypasses every traditional security control because there is nothing malicious to detect. The attacker never touches your infrastructure. The injected data arrives in a channel the agent treats as trusted. The code runs with your permissions on your machine.
We are three years into the AI coding assistant era. We have optimized for productivity, velocity, and developer experience. We have not optimized for security. And the gap is now being exploited.
The PraisonAI team patched within 4 hours of disclosure, but attackers were already scanning within 3 hours and 44 minutes. If a known authentication bypass can be weaponized before most teams finish their morning standup, what do you think happens when an attacker finds an unknown vulnerability in your MCP setup?
You do not get to find out after the breach. You need to fix this now.
Have you audited your coding agent's access? Have you checked what MCP servers your team is connected to? I want to hear about it.
Previously in the AI Agent Safety series:
Uchi Uchibeke builds tools that help developers ship secure AI agents without losing sleep. He is the founder of APort (open-source agent passports), Chimoney, and World Innovation League. When he is not stressing about MCP poisoning, he is probably watching The Good Doctor with his wife.
Top comments (0)