On June 24, 2026, Tenet Threat Labs, the research arm of Tenet Security (a startup founded by veterans of Cisco AI Defense and Israel's Unit 8200), published a technique they called Agentjacking: hijack an AI coding agent by poisoning the Sentry error data it reads. In controlled tests, the attack worked in 85% of attempts.
The concept is deceptively simple and devastating in practice: anyone who holds a public Sentry DSN can inject malicious "remediation instructions" into Sentry error events. When a developer asks their AI coding agent (Claude Code, Cursor, or OpenAI Codex) to "fix unresolved Sentry issues," the agent queries Sentry via the Sentry MCP server. The server faithfully returns the poisoned event as trusted system output. The agent then executes attacker instructions with the developer's full local privileges.
The exposure? 2,388 organizations with discoverable Sentry DSNs.
The technique was demonstrated in a controlled lab environment against three of the most-used AI coding agents in production today. Sentry reviewed the vulnerability and declined to fix it at the ingestion layer, stating the issue was "technically not defensible" on their side. The problem lives in the architectural seam between MCP servers and the agents that trust them.
Days earlier, on June 18, 2026, Microsoft Security Research disclosed AutoJack: a three-flaw chain in AutoGen Studio letting a single web page achieve host-level RCE against any machine running a web-browsing agent alongside a local MCP WebSocket server, no credentials required. The full chain and its fix are broken down in our gateway reference.
Taken together, the two disclosures marked June 2026 as the month agent security shifted from concept to deployment requirement.
How agentjacking works (and why it is hard to patch)
MCP (the Model Context Protocol, standardized by Anthropic in 2024) lets AI agents connect to external tools and data sources through a standardized interface. From the agent's perspective, data arriving through an MCP server carries implicit trust: it came through an authenticated, structured channel, not the raw internet.
Agentjacking exploits that trust at the data layer. Here is the attack path:
- An attacker obtains the target organization's Sentry DSN, often public in client-side JavaScript, README files, or CI/CD configs.
- The attacker crafts a fake Sentry error event containing a malicious instruction disguised as a stack trace comment or metadata field.
- A developer (or an automated pipeline) asks the coding agent to address open Sentry issues.
- The agent queries Sentry through the Sentry MCP server, which returns all open events, including the poisoned one.
- The agent interprets the malicious instruction as legitimate guidance and executes it.
The attack bypasses EDR tooling (no malicious binary executes at the OS layer), bypasses IAM controls (the agent uses the developer's existing credentials), and bypasses VPN checks (the request originates from the developer's own machine). It is a trusted-path attack.
The deeper problem is architectural. MCP servers were designed to give agents structured access to data, not to sanitize adversarially crafted content before presenting it. A posture that relies on each MCP server individually handling input validation amounts to hoping every server you connect to got it right, including the ones written before this attack class existed.
CSA Research notes the pattern extends well beyond Sentry: Elastic Security Labs documented command injection flaws in 43% of tested MCP server implementations, and 30% of a surveyed sample permitted unrestricted URL fetching. Any MCP-connected service that surfaces externally-controlled content (issue trackers, support queues, code-review platforms, log aggregators) carries the same structural exposure.
The market context, briefly
Agentjacking landed in the same June 2026 window as WitnessAI's Agentic Control GA, Databricks' Unity AI Gateway announcement at Data + AI Summit, and Tenet Security's own $6M seed round, the cluster of launches that organized the agent security gateway market. The vendor landscape, the five layers it splits into, and the full control set a gateway must enforce are covered in What is an AI agent security gateway; this post stays on the attack.
The test a gateway has to pass
Agentjacking gives gateway evaluation a concrete form: whatever your gateway does, does it prevent this attack? Blocking it requires two controls in particular. The gateway must inspect MCP response content before the agent acts on it, treating an authenticated structured channel as untrusted input rather than system output. And it must pre-authorize actions at the execution layer, because the injected payload does not have to look malicious; it just has to get the agent to take a harmful action.
Audit matters here for a specific reason: Sentry declined to fix agentjacking at ingestion, so the proof of an attack lives in the agent's tool call history, the sequence of MCP queries, the content returned, and the actions taken. Without conversation-level logging, incident response is reconstruction from fragments.
A product that only rate-limits LLM API calls, monitors token spend, or enforces system-prompt policy stops none of this. The complete enforcement list (discovery, MCP authentication, access policy, runtime inspection, audit, spend) is defined in the gateway reference.
Where this leaves engineering teams
AutoJack is fixed upstream. Agentjacking has no patch, and the Tenet researchers identified 2,388 exposed organizations.
For engineering leaders evaluating agent security posture today, the pragmatic starting point comes before any vendor decision: do I have any visibility into what my agents are doing? Most teams don't. Most don't know which agents are running, which MCP servers they're connected to, or what they did last Tuesday.
Visibility precedes policy. You cannot enforce what you cannot see.
The second question is: where are my agents' trust boundaries? Agentjacking works because agents trust MCP server output implicitly. Mapping every MCP server in use, every external data source that feeds into agent context, and every action class agents are permitted to take is the security posture audit that engineering teams need to run today, before the next disclosure.
The question agentjacking forces every engineering team to answer is simple: when your coding agent receives a response from an MCP server, does anything check it before the agent acts on it?
If the answer is no, agentjacking already knows what to do with that.
Datapace is building the context layer between your databases and your AI: resolved meaning validated by the people who own the data, the workload evidence beside it (cost, performance, usage and freshness, lineage), and a policy gate over what an agent may do and access, served over MCP. The design intent is that scope and approval are settled before an action runs, with every action recorded. If your agents reach production data through MCP, book a call and we will walk through that boundary on your stack.