Researchers at Tenet Security showed how anyone with a public Sentry DSN can inject a fake error report that coding agents like Claude Code, Cursor, and Codex will treat as a fix instruction. The agent fetches the malicious payload via the Model Context Protocol and runs arbitrary commands on the developer’s machine, exposing environment secrets and credentials. Sentry won’t close the write endpoint, leaving the fix to agent runtimes to filter untrusted data.