Security experts identified a method to compromise AI coding assistants using only a fabricated error notification. They label the technique Agentjacking. The approach requires no malware, stolen credentials or direct intrusion into the intended system.

Disclosed by Tenet Security, the method converts the coding assistant itself into the delivery mechanism. When a programmer requests help resolving an issue, the assistant executes the adversary code under the programmer own account and on the local workstation.

How the Agentjacking technique operates

The process begins with Sentry, a widely used error monitoring service. Sentry accepts error submissions through a public DSN key that appears in application source by design.

An adversary submits a fabricated report to the endpoint without authentication. The submission conceals a Resolution section containing a command styled to match Sentry native guidance.

Coding assistants retrieve Sentry data via the Model Context Protocol, which integrates external services. The assistant accepts the content as legitimate and cannot distinguish genuine crashes from injected entries. Consequently, when a developer requests resolution of open Sentry items, the assistant carries out the adversary instruction.

The assistant becomes the primary exposure

AI coding assistants have advanced from simple suggestions to full terminal operations, and demand continues to grow rapidly with one recent startup reaching substantial revenue. This expanded capability creates the vulnerability.

The technique succeeded against major platforms. Tenet reports successful compromise of Claude Code, Cursor and Codex at an 85 percent rate during testing. Researchers identified 2,388 exposed organizations ranging from large enterprises to individual developers and even a security provider.

Potential impact includes exposure of environment variables, cloud credentials, repository tokens and private repository addresses, opening routes to pipelines and infrastructure.

The method evades conventional defenses such as endpoint detection, network controls and access policies because every step appears authorized. Tenet refers to this as the Authorised Intent Chain. Safety instructions proved ineffective as agents executed commands despite explicit warnings about untrusted sources.

Responsibility for remediation remains unclear

Tenet notified Sentry on 3 June. Sentry recognized the issue yet declined a fundamental change, describing it as technically indefensible. The service implemented a narrow filter for one payload string, addressing only the immediate symptom.

The underlying concern extends beyond Sentry to any external data source consumed by agents, including tickets, repository comments and documentation. Separate experiments have shown similar risks with email agents leaking credentials.

The finding arrives as organizations accelerate agent deployment. An assistant connected to internal systems introduces a fresh entry point. Tenet emphasizes that mitigation must occur at the point where the assistant prepares to execute an action.