The attack surface isn't always a zero-day in the model. Sometimes, it's the quiet intersection of two 'working-as-designed' features. At DEF CON 34, Tenet Security dropped a proof-of-concept that makes the abstract threat of AI Agent poisoning concrete. The target? Sentry's public DSN ingestion. The vector? The MCP protocol. The result? A chain of events that can leak AWS keys, GitHub tokens, and npm registry credentials from a developer's machine with a single HTTP POST. This isn't a theoretical threat. It's a supply chain injection waiting for a trigger.
Context: The Architecture of Trust
Let's break down the surface. Sentry, the dominant error-monitoring platform, uses a Data Source Name (DSN) to identify a project. The design is intentionally permissive: any client can POST an error event to the ingestion endpoint as long as the DSN is valid. This is a feature, not a bug, for distributed crash reporting. Meanwhile, the Model Context Protocol (MCP) is an open standard that allows AI coding agents like Claude Code and Cursor to query external tools and data sources. Sentry's MCP server lets an agent fetch and analyze issues during debugging. Both features are individually sound. Together, they are a loaded weapon.
Core: The Order Flow of the Attack
An attacker scans public source code repositories or npm packages for exposed Sentry DSNs. Tenet found 2,388 exposed organizations. The attacker then POSTs a malicious error event to Sentry's endpoint, using the stolen DSN. The payload contains a crafted issue description, laced with markdown that reads like a diagnostic fix. This is not a phishing email. It's a poisoned data point inside a trusted system.
The developer, debugging a production issue, asks their AI agent to fetch the latest Sentry issues. The agent queries the MCP server, retrieves the forged event, and ingests the markdown as a legitimate instruction. The model has no semantic layer to differentiate between 'data' and 'instruction.' It executes the 'fix'—which is an indirect prompt injection. The fix tells the agent to run npm install malicious-package and then exfiltrate environment variables. The package is installed. The session is compromised. The agent's trust in the tool output is the flaw.
Tenet's controlled testing across 100+ organizations reported an 85% success rate. Bots don't feel, they execute. The chart is a map; the trader is the terrain. The attack path is a straight line.
Contrarian: The Retail vs. Smart Money Divide
The retail perspective is that this is a bug in Sentry or MCP that needs patching. The smart money sees the architectural trade-off. Sentry's refusal to do a 'root cause fix' is not negligence. Redesigning the ingestion model to require authentication for every event would break its core product. The content filter they deployed is a string-based blocklist. It's a leaky dam. An attacker can regenerate the payload with minor encoding changes and bypass it.
The real blind spot is the industry's obsession with 'alignment' at the model level. We assume the model is the only attack surface. This attack proves that the data pipeline is the new frontier. The MCP protocol is a trust-by-default system. Integrating a tool like Sentry without a trust boundary between the data source and the agent's reasoning engine is a fundamental design debt. Tenet's released tool, agent-jackstop, is a band-aid. It enforces network egress allowlists and command execution approvals. But it doesn't fix the architecture. Survival isn't about position sizing; it's about knowing when not to trade.
Takeaway: The New Risk Vector
The market is euphoric about AI coding agents. They are productivity multipliers. But they are also attack amplifiers. The Agentjacking attack takes a traditional risk—exposed API keys—and turns it into a weaponized payload delivery system. The question isn't if this will be exploited in the wild. It's when. The next iteration of security products won't just scan for vulnerabilities in code. They will audit the trust relationships between the agent and its data sources. Liquidity is the only truth that pays the bills. Here, the liquidity is the flow of data into the agent's context window. And someone is about to siphon it.
Hedge the ego, not just the portfolio. The developer's trust in their tools is the new asset. And it's about to be marked down.