Agentjacking at DEF CON 34: How public Sentry DSNs become an AI agent attack vector

Tenet Security took the DEF CON 34 stage in Las Vegas to show how a publicly exposed error-tracking credential and a Model Context Protocol (MCP) integration chain into remote code execution on a developer's machine. The presentation carried a blunt title: "Your WAF Blocked Us, That Was The Exploit — Remote Agent Takeover via Cloudflare, Sentry and Claude Zero-Day for data exfil."

On Sunday at LVCC Exhibit Hall West 3, CEO Barak Sternberg, CTO Nevo Poran, and researcher Ron Bobrov walked through the attack, which they say worked 85 percent of the time in controlled testing across more than 100 organizations.

The attack surface sits at the intersection of two legitimate design decisions. Sentry's error-tracking ingest endpoint accepts POST requests from anyone with a DSN — no authentication required — because that is how it works. AI coding agents like Claude Code and Cursor query Sentry through MCP integrations because that is how they debug. The gap between those two functions is the exploit.

Tenet identified 2,388 organizations with publicly discoverable Sentry DSNs, including 71 in the Tranco top-1 million websites. Through Cloudflare MCP integration alone, approximately 27 percent of Fortune 1000 companies were exposed. The target credentials: AWS keys, GitHub and GitLab OAuth tokens, npm and Docker registry tokens, Kubernetes credentials, and CI/CD secrets.

The chain runs in six stages. An attacker discovers a public DSN from JavaScript bundles, GitHub repositories, or scanning, then POSTs a crafted error event to Sentry's ingest endpoint with malicious instructions embedded in the error message fields — formatted as markdown that reads like legitimate remediation guidance. When a developer asks their coding agent to debug Sentry issues, the agent retrieves the injected event through MCP, treats the markdown as authoritative diagnostic instructions, and executes the attacker's commands with the developer's local privileges. A single npm install pulls a malicious package; the package exfiltrates credentials.

Sentry was notified on June 3, 2026, and deployed a global content filter targeting a specific payload string by June 12, but declined platform-level root-cause remediation, characterizing the change as "technically not defensible." Tenet argues the risk class extends to any MCP-connected agent consuming externally-influenced data, and that a payload-string filter addresses one exploit formulation, not the vulnerability pattern.

On the defensive side, Tenet released agent-jackstop, a set of drop-in hardening configurations for Cursor and Claude Code. The primary control is a deny-by-default network egress allowlist that blocks both the malicious package fetch and the exfiltration beacon; additional layers require explicit approval before executing commands, block credential reads at the subprocess level for directories like ~/.aws and ~/.ssh, and instruct agents to treat tool and log output as untrusted data.

The tool has limits: it covers Cursor and Claude Code, not every MCP-connected agent; it reduces blast radius without eliminating prompt injection; and it does not address the architectural problem the research identifies. Once an agent's MCP integration is active, every externally-influenced data source that agent consults becomes a potential injection point. No CVE was assigned, because this is not a patchable bug in a single vendor's product but a structural failure in how AI agents distinguish data from instructions.

The demonstration lands as AI coding agents become a standard part of developer toolchains, and it underscores that security in the agent era depends on how tools distinguish data from instructions. With no platform-level fix on the horizon, organizations running MCP-connected agents will likely have to adopt hardening measures like agent-jackstop while the industry debates whether protocols like MCP need structural changes.