Agentjacking

campaign · campaign:agentjacking-mcp-sentry-injection-2026

MCP injection of AI coding agents via forged Sentry error events (Tenet Security).

Coverage timeline

first 2026-06-13 → last 2026-06-13

Peak priority

notable

1 notable

Sources cited

2 hosts

Sections touched

research

Co-occurring entities

no co-occurrence

ATT&CK techniques

pinned v19.1 · see below

Hunting pivots

ATT&CK techniques

2 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1195Supply Chain Compromise×1

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Evidence: 2026-06-13/agentjacking-tenet-security-hijacks-ai-coding-agents-via-for · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-06-13/agentjacking-tenet-security-hijacks-ai-coding-agents-via-for · ATT&CK page ↗

Story timeline

2026-06-13"Agentjacking": Tenet Security hijacks AI coding agents via forged Sentry error events
research

Where this entity is cited

research1

Source distribution

tenetsecurity.ai1 (50%)
thehackernews.com1 (50%)

explore in graph

All cited sources (2)

Entries about Agentjacking (1)

2026-06-13 · view entry permalink →

NOTABLE

"Agentjacking": Tenet Security hijacks AI coding agents via forged Sentry error events

Tenet Security documented an MCP-injection attack class that abuses the implicit trust between AI coding agents and the Sentry error-tracking integration (The Hacker News, 2026-06-12). The attacker needs only a target's Sentry DSN — a write-only credential frequently exposed in client-side JavaScript or committed to GitHub — to publish a crafted error event embedding markdown-formatted instructions. When a developer later asks their coding agent to investigate that Sentry issue, the agent retrieves the injected event over MCP and executes the embedded instructions with the developer's own system privileges. Because every action the agent takes is one the developer nominally authorised, the technique reportedly slips past EDR, WAF, IAM and VPN controls (Tenet Security, 2026-06-12). Sentry acknowledged the disclosure but declined a root-cause fix, deploying only a content filter for a specific payload string; no CVE was assigned because the issue is an architectural trust-model gap in MCP. Maps to T1059 (agent-mediated command execution) and T1195. Defender action: audit MCP server integrations for any external service that can write content later surfaced to an agent; treat Sentry event content as untrusted, use a read-only Sentry service account/project for MCP, rotate exposed DSNs and remove them from client bundles and repos; alert when an agent tool-call chain involving Sentry events is followed by shell or filesystem writes.

research13 Jun 05:00Zmulti-sourceOpen finding ↗

Sources: The Hacker News · Tenet Security