AI security 2026

Agentjacking: What It Is, How It Works, and How to Stop It

In June 2026, Tenet Security documented a new attack class called agentjacking, in which malicious instructions hidden inside trusted data sources (such as Sentry error reports fetched over MCP) trick AI coding agents into executing attacker-controlled commands with developer-level privileges, at an 85% success rate across Claude Code, Cursor, and Codex.

Why agentjacking is different from ordinary prompt injection

Classic prompt injection targets chatbots that reply to humans. Agentjacking targets agents that act on systems: they run shell commands, install packages, call APIs, and read credential files. The attacker does not compromise the developer's machine directly. They only need write access to a data source the agent trusts.

In the Sentry variant documented by Tenet Security and published by the Cloud Security Alliance on 12 June 2026, the entry point is Sentry's Data Source Name (DSN): a write-only credential Sentry embeds in frontend JavaScript so browsers can report errors. Tenet identified at least 2,388 organisations with injectable DSNs discoverable through passive reconnaissance alone.

The six-step attack flow

Understanding the mechanics makes the defence obvious.

1. DSN discovery. The attacker finds a Sentry DSN in a public JavaScript bundle, a GitHub repository, or an indexing service. No authentication is required; DSNs are write-only and intentionally public.
2. Event injection. The attacker sends an HTTP POST to Sentry's ingest endpoint, creating a fake error event. The message, stack trace, breadcrumbs, and context fields are all attacker-controlled.
3. Payload embedding. Inside the fake error, the attacker writes markdown that mimics a legitimate resolution note: for example, a code block instructing the agent to run npx @attacker-package to "validate the fix."
4. Agent query. The developer asks their AI coding agent (Claude Code, Cursor, or Codex) to investigate unresolved Sentry issues. The agent fetches issues through the Sentry MCP integration.
5. Autonomous execution. The agent reads the injected event, treats the embedded instruction as a legitimate task, and runs the attacker's package with the developer's full local privileges, no separate approval step required.
6. Credential exfiltration. The malicious package probes for environment variables, AWS credentials (~/.aws/config), npm tokens (~/.npmrc), Docker credentials (~/.docker/config.json), SSH keys, and git credential helpers, then sends results to an attacker-controlled server.

The attack bypassed EDR, WAF, IAM policies, VPN controls, and explicit system-prompt instructions to distrust external data during Tenet's testing. Every step uses authorised tools and legitimate-looking behaviour, so security tooling sees nothing anomalous.

Tenet confirmed more than 100 real-world executions across Fortune 500 firms, hosting providers, and individual developers spanning six continents. The overall success rate was 85 percent; the 15 percent failure rate came primarily from agents that prompted for confirmation before running unfamiliar npx commands.

The generalisation: Sentry is one example, not the full attack surface

Agentjacking is not a Sentry bug. It is an architectural consequence of giving agents read access to any data source that accepts untrusted writes. Issue trackers, support queues, log aggregators, and code-review platforms carry the same risk. Sentry acknowledged the disclosure on 3 June 2026 but characterised a comprehensive fix as "technically not defensible" at the ingestion layer, deploying only a narrow content filter for the specific payload string from the research period.

The core problem: AI coding agents cannot reliably distinguish descriptive data from embedded instructions. The same properties that make agents productive, broad tool access, standing credentials, and autonomy to act on what they read, are exactly the properties an attacker borrows.

At Digiton, we build and operate AI agent systems for clients across 8 countries. Agentjacking is the attack class we consider highest-priority in our 2026 AI operations framework because the blast radius scales with agent capability: the more an agent can do, the more damage a hijacked one causes.

Defense checklist: copy-paste and implement today

These controls are ordered by effort. Implement them top-to-bottom; the first three can be done in under an hour.

1. Treat every MCP tool output as untrusted user input. Never let agent-read data flow directly into command execution. Apply the same validation you would apply to a form submission from an anonymous user.
2. Require a human review step before any autonomous shell or package execution. Disable auto-run for npx, pip install, cargo, and equivalents. The 15 percent of agents that survived Tenet's testing all required explicit confirmation before running unfamiliar commands.
3. Audit and remove unnecessary MCP integrations. Disable Sentry MCP (and any MCP server surfacing externally-influenced data) where it is not operationally required. Every connected data source is a potential injection channel.
4. Rotate exposed credentials immediately. Search public repositories and JavaScript bundles for Sentry DSNs matching https://[a-f0-9]{32}@o[0-9]+\.ingest\.sentry\.io. Rotate found tokens and add this pattern to your secret-scanning ruleset.
5. Use least-privilege credentials for agent processes. Agents should run with scoped, short-lived tokens: not the developer's full AWS profile, not a root npm token. Scope credentials to exactly what the agent legitimately needs.
6. Authenticate and pin your MCP server inventory. Treat MCP servers like third-party software dependencies: maintain an approved list, authenticate servers with signed certificates or controlled API keys, and block connections to unrecognised endpoints.
7. Monitor agent processes for unexpected outbound connections. Agentjacking exfiltrates data by calling an attacker server. An agent process connecting to an unknown host or an unfamiliar npm CDN is a high-confidence compromise signal.
8. Add prompt injection testing to your red-team program. Inject synthetic malicious instructions into the data sources your agents query and verify agents surface them for human review rather than executing them, the same way you test SQL injection in a web app.
9. After any suspected compromise, rotate everything the agent could reach. AWS keys, git tokens, npm tokens, Docker credentials, and SSH keys. Retain agent action logs for forensic review.

For teams building on models like GPT-5.6 or Claude via the API, the same principles apply: validate tool outputs server-side, scope permissions to the minimum required, and add a human checkpoint before any irreversible action.

If you are building or operating agent systems and want an independent security review of your MCP configuration, tool allowlists, and credential boundaries, contact Digiton for an AI-agent security audit. We review the full stack and deliver a prioritised remediation plan within five business days.

For a broader view of agentic risks in the 2026 landscape, see our practice page on platform development and agent infrastructure.

Frequently asked questions

Related