Agentjacking at DEF CON 34: a public Sentry DSN plus an MCP integration equals RCE on a developer's machine, 85% of the time
Tenet Security showed that Sentry's unauthenticated ingest endpoint lets anyone with a public DSN POST a crafted error event whose message fields contain markdown that reads like remediation guidance; when a developer asks Claude Code or Cursor to debug Sentry issues, the agent pulls the injected event through MCP and executes it with local privileges. In controlled testing across 100+ organizations the chain worked 85% of the time, and researchers found 2,388 orgs with publicly discoverable DSNs, 71 in the Tranco top-1M. Sentry deployed a payload-string content filter but declined platform-level remediation as 'technically not defensible'; no CVE was assigned, and Tenet's mitigation repo tenet-security/agent-jackstop ships deny-by-default egress allowlists for Cursor and Claude Code.
Source
↳ Follow the thread