Agentjacking: The Quiet Architecture Failure That Turns AI Coding Agents Into Weapons

Structure beats speculation every time. But what happens when the structure itself is the weak point? At DEF CON 34, Tenet Security unveiled a new attack vector that doesn't break algorithms—it breaks trust. It's called Agentjacking. And it makes every AI coding agent a potential backdoor into your infrastructure. 2,388 organizations. That's the number of publicly exposed Sentry DSNs Tenet identified. These are not obscure projects. They include Fortune 500 companies, major tech platforms, and critical infrastructure providers. Each one is a potential entry point for an attack that costs next to nothing to execute. I've seen this pattern before. In 2017, I analyzed over 500 ICO whitepapers. Back then, the pattern was hype without engineering. Today, it's adoption without security architecture. The same mistake, new skin. Context: The MCP (Model Context Protocol) is a standard being pushed by Anthropic to connect AI agents to external tools and data sources. Sentry is a popular error monitoring service used by developers worldwide. The combination is powerful: a developer can tell his AI coding agent to "debug this Sentry issue" and the agent will automatically fetch error details, analyze them, and even suggest fixes. It's a productivity hack. But it's also a vulnerability. Here's the core: The attack is a form of indirect prompt injection. The attacker finds a public Sentry DSN (a unique identifier used to send error data to Sentry). Since Sentry's ingestion endpoint accepts any POST request with a valid DSN, the attacker can craft a malicious error event. This event contains markdown that looks like a legitimate fix suggestion—but it's actually a covert instruction. When the developer asks his AI agent to look at the Sentry issue, the agent reads the malicious error event. The markdown is interpreted as a command. The agent then executes it: running an npm install that installs a malicious package, which steals credentials from the developer's machine. AWS keys, GitHub tokens, Docker registry credentials—all siphoned. This isn't a lab experiment. Tenet achieved an 85% success rate in controlled tests across 100+ organizations. The attack chain is complete: (1) discover public DSN, (2) POST malicious error event, (3) developer triggers agent to read issue, (4) agent treats markdown as fix instruction, (5) agent executes malicious npm install, (6) credentials are exfiltrated. The entire attack requires a single HTTP POST. No persistence. No complex exploit. It's a commodity attack blueprint. But here's where the story gets interesting. Sentry was notified. They deployed a content filter—a simple string-based blacklist targeting specific payloads. That's a band-aid, not a fix. The underlying architecture flaw remains: the Sentry ingestion endpoint still trusts any authenticated DSN. The MCP protocol still treats all tool output as equally trustworthy. The model still cannot distinguish between data and instructions in a semantic layer. 2017 called. It wants its lessons back. Now, the contrarian angle. Everyone is panicking about the attack itself. But the real crisis is the architecture. The industry is rushing to build AI agents that can autonomously interact with external tools, but we haven't built the trust boundaries. We're building a highway without guardrails. The Curse of the 2017 ICO Mania is repeating: teams are optimizing for speed to market, not for structural integrity. The MCP standard needs a security extension—something like a "content trust" layer that tags every tool output with a confidence score and an instruction intent flag. Without it, every data source becomes a potential injection point. The contrarian view also questions the 85% success rate. Tenet's test was controlled. The real-world success depends on the developer actively asking the agent to debug the Sentry issue. If the developer doesn't trigger the workflow, the attack sits dormant. But that's a weak defense. Social engineering can easily nudge a developer toward that action. The attack doesn't need to be automatic; it just needs to be plausible. What's the takeaway? The bear market demands survival thinking. This attack is a signal that the AI agent ecosystem is bleeding. Protocols that integrate with external data sources without proper sanitization are sitting on a ticking time bomb. The next narrative will be about "Agent Security". The firms that invest in structural trust layers—like signed envelopes for error reporting, data source reputation scoring, and command execution audits—will survive. The rest will be exposed. I've been in this space for 22 years. I've seen the patterns. The ICO boom ended with a crash because the architecture was too thin. The DeFi boom ended with a crash because the composability without security led to hacks. Now the AI agent boom is showing the same cracks. The narrative is shifting from "what can AI agents do" to "how do we trust them?". The winners will be the ones who build the trust infrastructure. The losers will be the ones who ignore the architecture. Structure beats speculation every time. But only if the structure is secure. Today, the structure of AI coding agents is built on trust—and trust is a vulnerability. The market will soon learn that lesson. Again.