In a world of noise, code is the only quiet truth. But when AI agents start treating error logs as executable commands, the quiet truth becomes a whisper drowned out by the noise of compromised credentials.
At DEF CON 34, Tenet Security revealed a vulnerability chain that should chill every developer using AI coding assistants: Agentjacking, an attack that exploits the trust relationship between AI agents and public error monitoring services like Sentry. The attack is not a novel cryptographic exploit or a zero-day in the model itself. It is a combination attack—a systemic composition of legitimate design decisions that, when stacked, create a credential theft highway with minimal attacker effort.
Let me be clear: this is not a bug in Claude Code or Cursor. It is a failure of architecture—the same kind of failure that caused the 2016 DAO hack, the same failure that led to countless DeFi exploits. The problem is that the AI agent’s reasoning context cannot distinguish between data and instructions. When an agent reads a Sentry issue through the Model Context Protocol (MCP), the markdown content—including attacker-injected “fix suggestions”—is treated as context, not as potentially malicious input. The agent then executes those suggestions, installing npm packages that exfiltrate AWS keys, GitHub tokens, and Docker registry credentials.
Here is the technical chain as I understand it from the research: First, an attacker discovers a public Sentry DSN—a 32-character key that identifies a project and allows anyone to send error events to that project. There are 2,388 organizations with publicly discoverable DSNs, including 71 sites in the Tranco top 1 million. The attacker sends a crafted error event containing a markdown block with a fake “fix suggestion.” The developer, using an AI coding agent, asks the agent to debug a Sentry issue. The agent fetches the issue via MCP, reads the markdown, and interprets the fake fix as a legitimate instruction. It runs npm install malicious-package. The package steals credentials from the developer’s machine. The attack does not require model jailbreaking. It exploits the default trust that AI agents extend to data sources they are configured to read.
This is not a hypothetical. Tenet’s controlled tests showed an 85% success rate across 100+ organizations. The attack is automated: an attacker can scan for public DSNs, POST malicious events, and wait for a developer to trigger the agent. The cost is negligible—a single HTTP request establishes the attack condition.
Now, the industry response reveals the deeper problem. Sentry deployed a content filter blocking specific payload strings. This is a band-aid. It is the equivalent of a DeFi protocol adding a basic require statement to prevent a reentrancy attack while leaving the underlying vulnerability intact. The filter is an IoC-level string blacklist, trivially bypassable with simple obfuscation. Tenet released agent-jackstop, a configuration hardening tool that adds network egress allowlists, command execution approval prompts, and subprocess credential protection. These are necessary mitigations, but they do not solve the root cause: the MCP protocol itself has no mechanism to mark tool outputs as “untrusted context” or to separate data from instructions.
From my experience auditing smart contracts in 2017, I recognize this pattern. The ERC-20 standard had a vulnerability not because of a single flaw, but because of the intersection of two safe features: the allowance mechanism and the transferFrom function. Similarly, here, the intersection of public DSNs (a feature for error ingestion) and MCP (a feature for agent data access) creates an exploitable gap. The lesson is the same: trust boundaries must be mathematically enforced, not just assumed by design.
The contrarian angle is that the real solution is not more filters or endpoint hardening. It is a fundamental redesign of how AI agents evaluate external data. We need a trust model for agent inputs, similar to how blockchain oracles are evaluated. Every data source used by an agent should carry a provenance signature and a credibility score. The agent should be able to verify that the data has not been tampered with, and that the data type is “error report” not “execution instruction.” This is not a trivial engineering problem—it requires changes at the protocol level, ideally in MCP specification itself. But until then, every public DSN is a potential attack vector, and every developer using AI coding agents is one MCP query away from credential theft.
I have seen this cycle before. In 2020, during DeFi summer, I watched protocols deploy yield farms without auditing their liquidation mechanisms. The result was a cascade of oracle manipulation attacks. The market did not learn until millions were lost. The same is happening now with AI agents. The industry is racing to build features—MCP integrations, agentic coding—without building the security infrastructure to support them. We are in the pre-consensus phase of agent security. The standards have not been written. The tools are not hardened. The attackers are already here.
My advice to Web3 founders and developers using AI agents: treat every external data source as adversarial. Assume your Sentry DSN is public. Assume your MCP server is compromised. Apply zero-trust principles to your agent’s context window. Do not trust the agent to distinguish between a bug report and a malicious payload. Code is the only quiet truth, but code can also be weaponized. The only way to win is to verify everything, trust nothing.
The takeaway is not paralysis. It is preparation. The next 12 months will see an explosion of agent security tools, from MCP security gateways to AI-powered content sanitization. The organizations that adopt these tools early will be the ones that survive the next wave of attacks. The rest will learn the hard way that decentralization is a feature, not a slogan—and that trust is a liability until it is mathematically verified.