{
  "entry": {
    "kind": "vuln",
    "slug": "agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp",
    "name": "agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp",
    "vendor": "AI coding agents integrating a Sentry DSN / Sentry MCP",
    "description": "Tenet Security's Threat Labs documented \"AgentJacking\": a public Sentry DSN (logging key) left exposed in a project lets an attacker intercept and proxy the agent's Sentry/MCP traffic, modifying the AI agent's responses to inject malicious code or alter the instructions the developer sees. It affects AI coding agents wired to a Sentry DSN / Sentry MCP integration, Claude Code, Cursor, and Codex.",
    "website": "https://www.getreadyforagents.com/news/claude-code-cursor-codex-agentjacking-sentry-mcp/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-06-24",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp",
      "aliases": [
        "ti-035"
      ],
      "title": "AgentJacking: Public Sentry DSN Hijacks Claude Code, Cursor & Codex via MCP",
      "summary": "Tenet Security's Threat Labs documented \"AgentJacking\": a public Sentry DSN (logging key) left exposed in a project lets an attacker intercept and proxy the agent's Sentry/MCP traffic, modifying the AI agent's responses to inject malicious code or alter the instructions the developer sees. It affects AI coding agents wired to a Sentry DSN / Sentry MCP integration, Claude Code, Cursor, and Codex.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Supply chain compromise"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "AI coding agents integrating a Sentry DSN / Sentry MCP",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/cursor"
      },
      "affected": [
        {
          "range": "AI coding agents integrating a Sentry DSN / Sentry MCP (June 2026)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-06-24",
      "modifiedAt": "2026-06-24",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.getreadyforagents.com/news/claude-code-cursor-codex-agentjacking-sentry-mcp/"
        }
      ],
      "mitigation": "Treat Sentry DSNs as secrets; never commit them or expose them in client-side or project config; rotate any exposed DSN. Lock the agent MCP server list to an approved allowlist and require explicit approval for new servers. Monitor agent network traffic for unexpected proxy/C2 endpoints.",
      "detectedByAnomity": true
    }
  }
}