Tenet Security’s Threat Labs team calls agentjacking an attack that hijacks AI coding assistants—Claude Code, Cursor and Codex—through Sentry, the error-monitoring service. Anyone who grabs a project’s public Sentry DSN—a write-only credential meant for JavaScript error reporting—can send a fake error event. That event, crafted with markdown headings and a “resolution” section, looks like Sentry’s own format. When a developer tells their agent to fix unresolved Sentry issues, the agent pulls in that fake resolution as an instruction and runs whatever command sits inside the code block. The steps all look normal on paper. First an attacker finds the DSN in site JavaScript or on GitHub. Then they post one bogus error to Sentry’s ingest endpoint, authenticated only by the DSN. Next a developer asks the agent to resolve errors; the agent reads Sentry’s response through the Model Context Protocol and treats the fake resolution like trusted guidance. Finally the agent executes an npx command on the developer’s machine—often pulling a malicious npm package that exfiltrates AWS keys, GitHub tokens or other secrets. In tests across 2,388 organizations—71 of them among the Tranco top-1M—Tenet saw an 85% success rate and more than 100 confirmed code executions. One hit a developer inside a $250 billion Fortune 100 tech firm. Agents in CI pipelines, WSL on Windows, macOS and corporate VPNs all fell. The attack never touches victim infrastructure or asks for passwords, so firewalls, EDR, WAFs and IAM systems stay silent. Prompt-layer defenses fail too: Claude Code and others ran the injected payload despite instructions to ignore untrusted data. Stopping agentjacking means adding checks at runtime, where each command sourced from external data can be gated. Sentry’s content filter only blocks known strings, and model vendors haven’t built in tougher filtering. The only effective control sits in the agent runtime itself—letting teams reject or sandbox any action that didn’t originate in authenticated source code.