Agentjacking: The Architecture of Trust Collapse in AI Agent Data Pipelines

Over the past seven days, a single DEF CON 34 presentation quietly redefined the threat model for AI-assisted development. Tenet Security demonstrated a proof-of-concept attack chain that achieved 85% success rate against 100+ organizations, using nothing more than a public Sentry DSN and a POST request. The target wasn't a vulnerable smart contract or a misconfigured bridge. It was the AI coding agent sitting on developers' machines, trusted to read error logs and suggest fixes. The attack didn't exploit a zero-day in any model. It exploited an architectural flaw: the inability of current agent systems to distinguish data from instruction. Context: The protocol is MCP (Model Context Protocol), the tool is Sentry's error monitoring platform, and the agent is either Claude Code or Cursor. The intersection of these three legitimate components creates a blind spot. Sentry's endpoint accepts any POST containing a valid DSN — no authentication needed. AI coding agents fetch Sentry issues via MCP to assist debugging. The combination means an attacker who discovers a public DSN (and there are 2,388 such organizations publicly exposed) can inject arbitrary error events containing markdown that looks like a fix. The agent, unable to parse semantic intent, treats the injected markdown as a repair instruction and executes it. The result: npm install on a malicious package, credential exfiltration, and a compromised development environment. Core: This is a systematic teardown of a six-stage attack chain — discovery of public DSN, POST of malicious event, developer triggers agent to read Sentry issue, agent interprets markdown as instruction, npm install executes, credentials are stolen. The attack is structurally identical to indirect prompt injection, but the delivery vector is new: error monitoring as a command injection channel. My audit experience tells me that when two systems each trust the other's data format without semantic validation, you get a combinatorial explosion of attack surface. The 2,388 exposed DSNs are not abstract numbers. Each represents a real organization whose developers may have triggered an agent to fix a fake error. The 71 DSNs within the Tranco top 1 million websites mean this attack scales to high-value targets. The 27% of Fortune 1000 companies exposed via Cloudflare MCP integration suggests enterprise adoption of AI coding agents has already created a supply chain vulnerability that most security teams haven't modeled. Sentry's response — a content filter blocking specific payload strings — is a classic stopgap. It's an IoC-level blacklist, trivially bypassable with simple payload obfuscation. Tenet's agent-jackstop tool is a drop-in configuration that enforces network egress whitelisting, command approval, and credential isolation. These are damage reduction measures, not root-cause fixes. The root cause is that MCP's data model lacks an instruction intent marker. The model cannot say "this block of text is data, not code." Until the semantic layer is fixed, every tool output is a potential injection vector. Contrarian: The bulls got one thing right. The attack requires a human trigger — the developer must ask the agent to read the Sentry issue. It's not a fully automated worm. But that's a thin comfort. The 85% success rate in controlled tests suggests that when a developer says "debug this error," the agent's default behavior is to trust the error content. The assumption that a human-in-the-loop prevents exploitation is false; the human is the loop, not the guard. The attack is a collision of two design decisions that are individually reasonable — Sentry's open ingestion for flexibility, MCP's data-fetching for utility — but collectively create a gap. The contrarian view is that this is not a vulnerability in Sentry or MCP alone, but a systems integration failure. Fixing the root cause requires protocol-level changes that neither party is incentivized to implement alone. Volatility is just liquidity leaving the room. Trust is a variable I refuse to define. Trust is a variable I refuse to define. Takeaway: The industry will respond with agent security gateways, MCP trust layers, and signature-based error reporting. These are bandages. The real question is whether the model training pipeline can be taught to enforce an instruction hierarchy that treats all tool output as untrusted data. Based on my audit of AI-generated code bypasses in 2024, I don't believe that's happening in production anytime soon. Until then, every AI coding agent is a credential leak waiting for a public DSN. Trust is a variable I refuse to define.