Agentjacking: Fake Sentry Errors Tricked Claude Code and Cursor Into Running Attacker Commands

Security firm Tenet Security disclosed a technique it calls agentjacking, in which attackers plant fabricated errors in public Sentry error feeds. Sentry DSNs, which are embedded in frontend JavaScript, permit anyone to submit events but were treated as harmless because they grant no read access. The attack became dangerous once Sentry's MCP server let AI coding agents read those feeds, since a planted error can contain instructions disguised as a resolution. In Tenet's tests across more than 100 organizations, agents including Claude Code, Cursor and Codex ran the planted commands about 85% of the time. Tenet identified 2,388 organizations with injectable DSNs, and the findings were reported by The Hacker News on June 12, 2026.