AgentJacking: Public Sentry DSN Hijacks Claude Code, Cursor & Codex via MCP
AgentJacking: Public Sentry DSN Hijacks Claude Code, Cursor & Codex via MCP is a high-severity prompt injection issue in AI coding agents integrating a Sentry DSN / Sentry MCP, a MCP server. Affected: AI coding agents integrating a Sentry DSN / Sentry MCP (June 2026).
Is AI coding agents integrating a Sentry DSN / Sentry MCP running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp- Severity
- high
- Attack type
- Prompt injection, Supply chain compromise
- Component
- Cursor · MCP server
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Tenet Security's Threat Labs documented "AgentJacking": a public Sentry DSN (logging key) left exposed in a project lets an attacker intercept and proxy the agent's Sentry/MCP traffic, modifying the AI agent's responses to inject malicious code or alter the instructions the developer sees. It affects AI coding agents wired to a Sentry DSN / Sentry MCP integration, Claude Code, Cursor, and Codex.
Affected versions
| Affected | Fixed in |
|---|---|
AI coding agents integrating a Sentry DSN / Sentry MCP (June 2026) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run AI coding agents integrating a Sentry DSN / Sentry MCP (June 2026).
How do I fix it?
Treat Sentry DSNs as secrets; never commit them or expose them in client-side or project config; rotate any exposed DSN. Lock the agent MCP server list to an approved allowlist and require explicit approval for new servers. Monitor agent network traffic for unexpected proxy/C2 endpoints.
How do I find every machine running AI coding agents integrating a Sentry DSN / Sentry MCP?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run AI coding agents integrating a Sentry DSN / Sentry MCP and which version, then enforce a policy on it.