At DEF CON 34, Tenet Security unveiled a 6-stage attack chain that achieved an 85% success rate against 2,388 organizations using public Sentry DSNs. The attack, dubbed Agentjacking, exploits a fundamental architectural flaw in how AI coding agents integrate with external data sources via the Model Context Protocol (MCP). This is not a model-level vulnerability—it is a composability failure that mirrors the reentrancy and oracle manipulation risks we've seen in DeFi. Tracing the data flow back to the first POST, the attack chain is elegant in its simplicity: an attacker sends a crafted error report to a public Sentry DSN, the developer's AI agent (Cursor or Claude Code) reads the issue via MCP, interprets the markdown as a repair instruction, executes npm install on a malicious package, and leaks credentials. The root cause: AI agents cannot distinguish between data and instructions when the data arrives through a trusted channel. This is a trust boundary problem, and it has profound implications for blockchain infrastructure that relies on oracles, bridges, and off-chain data feeds.
Context: The Architecture of Trust
The MCP is an open protocol designed to connect AI agents with external tools and data sources. Sentry, a popular error monitoring service, exposes an ingestion endpoint that accepts any POST containing a valid DSN—no authentication required. When a developer configures an AI coding agent to query Sentry for debugging, the agent's MCP server retrieves issue data and injects it into the agent's context. The agent, trained to follow instructions, treats the markdown in the error report as a legitimate fix. This is the architectural equivalent of a smart contract blindly trusting an oracle's price feed without verifying the source. The attack succeeds because the two design decisions are individually valid: Sentry's open ingestion is efficient for error collection, and MCP's context injection is powerful for debugging. But their intersection creates a gap that can be weaponized.
Core: Dissecting the Attack Chain
I reverse-engineered the attack chain based on Tenet's disclosure and my own experience auditing agent architectures. The chain has six stages:
- Discovery: The attacker scans for public Sentry DSNs. Tenet found 2,388 organizations with exposed DSNs, including 71 in the Tranco top 1 million websites and approximately 27% of Fortune 1000 companies using Cloudflare's MCP integration.
- Injection: The attacker sends a POST to the Sentry endpoint with a crafted error event containing a markdown block that simulates a repair instruction, such as
npm install attacker-package.
- Trigger: The developer encounters an error and asks the AI agent to investigate. The agent queries Sentry via MCP and retrieves the attacker's crafted issue.
- Interpretation: The AI agent treats the markdown as a legitimate fix, executes the command, and installs the malicious package.
- Exfiltration: The malicious package contains a post-install script that steals credentials from the developer's machine: AWS keys, GitHub OAuth tokens, GitLab tokens, npm/Docker registry tokens, and other sensitive secrets.
- Exploitation: The attacker uses the stolen credentials for lateral movement, supply chain attacks, or direct financial gain.
Tenet's test showed an 85% success rate across 100+ organizations. The attack does not require bypassing model-level jailbreaks; it exploits the default trust an AI agent places in tool outputs. This is identical to the risk of composability in DeFi: when two protocols interact without verification layers, an attacker can cascade a failure from one to the other. Composability is a double-edged sword for security.
Contrarian: The Blind Spots in the Mitigation
The responses from both Sentry and Tenet reveal the limits of current thinking. Sentry deployed a content filter targeting specific payload strings—a classic IoC-level blacklist that can be bypassed with simple obfuscation. Tenet released agent-jackstop, a drop-in configuration that enforces network egress white lists, command execution approvals, and subprocess-level credential protection. These are tactical fixes that reduce the blast radius but do not address the root cause: the MCP protocol lacks a mechanism for data provenance and instruction separation.
The real blind spot is that the attack does not require the attacker to compromise Sentry or the MCP server. It only requires a public DSN and a developer who uses an AI agent. This is a supply chain attack on the agent's data ingestion path. In blockchain terms, it is equivalent to a price oracle that accepts any unsigned data feed. The industry has learned that trustless verification layers—such as threshold signatures, ZK proofs, or decentralized oracle networks—are necessary to protect against such manipulation. Yet AI agent infrastructure is being built without these safeguards.
Another blind spot: the 85% success rate was measured in a controlled environment with developers who were actively asking the agent to debug Sentry issues. In real-world scenarios where the agent operates autonomously or with less supervision, the success rate could be higher or lower. The attack vector is not purely automated—it requires the developer to trigger the agent's Sentry query. But once that trigger is pulled, the exploitation is fully automated.
Takeaway: The Vulnerability Forecast
The Agentjacking attack is a preview of what will become a systemic issue in AI agent infrastructure. As agents gain more autonomy—executing shell commands, approving transactions, managing smart contracts—the risk of such data-driven attacks will escalate. The blockchain industry has already solved similar problems with oracles, composability audits, and formal verification. The AI agent ecosystem needs to adopt trustless verification layers, such as cryptographic signatures on tool outputs, context-level instruction filtering, and on-chain attestation of agent actions. Without these, every MCP integration is a backdoor waiting to be exploited. The question is not if a large-scale agentjacking breach will occur, but when—and whether the industry will learn from DeFi's mistakes before it does.
