Tenet Security’s June disclosure describes a vulnerability dubbed “agentjacking”: a single crafted Sentry error event, sent via a public DSN, was able to inject attacker-controlled instructions that AI coding agents executed. In controlled tests the researchers examined more than 100 targets and achieved an 85% success rate — the agent executed the attacker’s code with the developer’s full privileges and no alert fired. Tenet wrote that Sentry’s architecture makes the flaw “technically not defensible.”
Why existing controls missed it
In Tenet’s scenario EDR, WAF, IAM, and firewalls all failed to detect the attack because every step in the chain was authorized. The attacker made a valid Sentry API call using a public DSN; the MCP server returned the injected event as authentic output; the agent treated it as trusted diagnostic data and executed the instruction. That execution led to exposure of cloud credentials and source-control tokens. Tenet captured a live AWS secret access key and private repository URLs in one Claude Code environment.
Scope and risk
Tenet identified 2,388 organizations with publicly exposed Sentry credentials that could be abused to inject malicious events at scale. The research is a proof-of-concept and does not assert confirmed exploitation across all 2,388 organizations, but it demonstrates the scale of potential exposure. The advisory warns that if your AI coding agents are connected to Sentry, Datadog, PagerDuty, Jira, or any MCP-connected data source developers trust — and those agents can execute shell commands — your stack likely shares the same blind spot.
Because the Sentry architecture intentionally exposes DSNs for frontend error reporting, the recommended mitigation is not simply revoking the DSN but restricting what agents can do with the data those DSNs return.
How agentjacking works
Agentjacking succeeds because every action is authorized: a public DSN carries a valid API call, the MCP returns the injected event as legitimate, and the agent executes it with developer privileges. No signature or traditional alert is generated; operators see benign diagnostics while the agent quietly exfiltrates credentials.
SOC teams historically never needed to distinguish between a human running an npm install and an agent doing so. That distinction became critical once AI coding agents entered production; stacks that cannot make that distinction are exactly what agentjacking bypasses.
Surveys and a recurring pattern (H1 2026)
Multiple independent surveys from the first half of 2026 show enterprises often trust AI agents more than their controls justify:
- Okta/Apprize360 (292 executives, 492 knowledge workers): only 34% always apply the same security controls to agents as to humans; 52% of employees use unapproved AI tools; 58% of executives reported an AI-related incident or near miss in the prior year.
- HiddenLayer AI Threat Landscape 2026 (250 IT and security leaders): 33% reported agents already exceeded intended scope; 31% could not confirm whether they had experienced an AI breach. One in eight AI breaches was linked to agentic systems.
- Gravitee (900+ executives and practitioners): only 14.4% of agents went live with full security approval; 88% reported confirmed or suspected incidents. An April follow-up of 750 leaders found agent estates had doubled while monitoring barely increased.
The runtime security gap
CrowdStrike frames agent protection as similar to securing highly privileged users: agents have identities, access to underlying systems, they reason and take action. CrowdStrike’s fleet data shows more than 1,800 agentic applications and approximately 160 million instances under monitoring on enterprise endpoints. On June 15, 2026 CrowdStrike shipped Continuous Identity for AI Agents at Identiverse, moving from static policies to continuous, action-level authorization that validates every agent action in real time; the vendor says this control class is becoming a baseline procurement criterion.
Elia Zaitsev, CrowdStrike CTO, warned that sandboxes that prevent an agent from touching anything make the agent worthless, because agents derive value from access — and every access grant is an attack surface. The missing safety net for many organizations is runtime security that observes and constrains agent behavior in production.
Recommended actions and the five-question gap test
The article proposes a five-question gap test (drawing on the H1 2026 surveys) to evaluate the most important weaknesses agentjacking exploits: agent inventory, controls parity, scope drift, governance perception, and breach detection certainty. Key recommendations include:
- Immediately audit all publicly exposed DSNs, especially Sentry.
- Treat every agent as a privileged insider; apply the same access reviews and revocation timelines as for human employees.
- Add every production agent to the next access review cycle and replace shared API keys with scoped, short-lived tokens. Require human-in-the-loop for any agent action that touches PII, financial data, or production infrastructure.
- Require agent-specific runtime detection in procurement. Ensure you can distinguish agent-initiated actions from human-initiated ones in production telemetry and attribute a specific action to a specific agent within 60 minutes.
Conclusion
Agentjacking removes a long-standing assumption in security architecture: that authorization implies safety. Tenet’s proof-of-concept shows that when each step is legitimate, traditional network and access controls can be blind to a chain of abuse. The necessary defense is not only policy or static permissions but runtime visibility and enforcement of what agents actually do.
Regulatory note: EU AI Act high-risk compliance obligations take effect August 2, 2026; organizations should factor this into Q3 planning.
