Tenet Security: Agentjacking Hits 2,388 Orgs via Sentry

Tenet Security researchers Ron Bobrov, Barak Sternberg, and Nevo Poran have disclosed agentjacking, a new attack class that smuggles malicious instructions into Sentry error-tracking events, which AI coding agents then execute with full developer privileges. The attack exploits Sentry DSNs, described in the research as "a public, write-only credential that's embedded in websites." Any attacker can inject a crafted error event; when a developer asks Claude Code or Cursor to fix unresolved Sentry issues, the agent retrieves the payload and runs it as trusted guidance. As the researchers put it: "The attacker never touches the victim's infrastructure. The malicious instruction arrives disguised as a legitimate Resolution inside an ordinary error." Essentially: (Tenet Security, Sentry) are at the center of a silent, at-scale credential-theft loop neither side can currently close. - Tenet found at least 2,388 organizations with valid injectable Sentry DSNs. - Testing across AI coding assistants showed an 85% exploitation success rate. - Exfiltrable data includes environment variables, Git credentials, private repository URLs, and developer identities. Sentry acknowledged the issue but declined to fix it, calling it technically not defensible, and activated only a global content filter blocking a single specific payload string.