Agentjacking: Sentry MCP Injection Turns Observability Telemetry into Code Execution

Sentry DSNs are write-only credentials that appear in any website's source code. They are supposed to be public. Sentry documents this explicitly: the DSN is safe to embed in client JavaScript because it only allows event submission, not data reads. That framing is correct for a human developer looking at Sentry's dashboard. It stops being correct when an AI coding agent is wired to Sentry via MCP and trusted to act on what it finds there.

The attack chain Tenet Security documented is called Agentjacking. An attacker retrieves a target organisation's Sentry DSN from the application's JavaScript or a GitHub search, then posts a crafted error event via a normal HTTP POST to Sentry's ingest endpoint. The event uses carefully formatted markdown in its message field: plausible-looking error context, a fake resolution section, and an npx command disguised as a recommended fix step. No authentication beyond the DSN is required at any point.

When a developer asks their AI coding agent to fix unresolved Sentry issues, the agent queries Sentry via the Sentry MCP server. The injected event is returned alongside legitimate errors, visually and structurally indistinguishable from Sentry's own template output. The agent does not distinguish between events generated by a real application crash and events posted by an attacker. It interprets the fake resolution steps as legitimate diagnostic guidance and executes the embedded command, running an attacker-controlled npm package with the developer's full local privileges.

The package then reads environment variables, AWS credentials, cloud configuration, Git credentials, private repository URLs, and developer identity data, and transmits them back. Every step in the chain is authorised. The agent performs only operations it was given permission to do. No EDR signature fires, no WAF inspects the traffic, no IAM policy triggers. Sentry described comprehensive fixes as technically not defensible and deployed only a content filter targeting the specific payload string Tenet used, which any variant payload circumvents.

Apply Tenet Security's open-source agent-jackstop configurations for Cursor and Claude Code, which constrain agent command execution from untrusted tool output. Review and restrict which Sentry projects are accessible via your MCP integration. Do not grant MCP-connected agents ambient access to production cloud credentials: use short-lived, task-scoped tokens instead. For any workflow where an agent queries observability platforms, require human confirmation before executing commands surfaced from those queries. Monitor for npx or npm install invocations that originate from the AI agent process rather than the developer's terminal.