Agentjacking: a write-only Sentry key turns your error tracker into a remote shell

A public DSN. That's all the attacker needs. Not your credentials, not a compromised dependency, not a phishing link. The same write-only Sentry key that's sitting in your frontend bundle right now, by design, so the browser can report errors.

Tenet Security and the Cloud Security Alliance disclosed "Agentjacking" this week: malicious instructions injected into Sentry error events, which MCP-connected coding agents then dutifully retrieve and execute with your own system privileges (The Hacker News). Your agent pulls a stack trace to help you debug. The "stack trace" tells it to run a command. It runs the command. Controlled tests hit roughly 85% success across more than 100 organizations. And here's the part that should make you sit up: the chain bypasses EDR, WAF, IAM, and firewalls, because every single step is technically authorized. The agent has the permissions. The DSN is supposed to accept writes. Nothing is "exploited" in the classic sense. It's all legitimate activity, composed into something that copies your secrets out.

Sentry's response was the tell. They declined a root-cause fix and called the attack class "not defensible" at the platform level. I actually respect the honesty. They're right that you can't validate at the platform what's malicious in arbitrary user-supplied error text. But it means the defense is yours.

The principle generalizes way past Sentry, and that's why this is a top story rather than a one-vendor CVE. Any data your agent ingests from an external system is untrusted input that might be code. Error events. Web pages (see FORGE in Security, where one polluted page flips product recommendations up to 27%). Config files (see the CLAUDE.md worms, same section). This is Simon Willison's Lethal Trifecta playing out in production: an agent with access to private data, exposure to untrusted content, and the ability to act. Agentjacking is what happens when all three line up through your observability stack, the one place you'd never think to sandbox.

What to do: stop treating ingested error events as trusted. If you've wired an error-tracking MCP server into Claude Code, Cursor, or Codex, that retrieval path needs the same scrutiny as any user input boundary. Strip or sandbox tool outputs before they hit the model's action loop. And reconsider whether your debugging agent needs write-capable tools in the same context where it reads third-party data. The convenience of "the agent fixes the bug from the error report" is exactly the gadget being weaponized.