You connected a Sentry MCP server to Claude Code. It’s not an advanced setup — Sentry provides official integration docs, and a few lines of config let your agent check errors and fix bugs for you every day.
Sentry is an error monitoring service. When your app crashes, it automatically collects stack traces, context, and user action paths, aggregating them into a dashboard. Developers use it daily to troubleshoot production issues. Its MCP server brings this capability into AI agents: the agent can directly query Sentry’s error list, read the details of each error, and then automatically fix bugs. It’s one of the most commonly used MCP integrations. The speed of MCP ecosystem expansion means more and more developers are doing the same thing every day in their workflow: handing their permissions to an agent and letting it autonomously process information returned by external services.
One ordinary Thursday afternoon, you open your terminal and tell your agent: fix the unresolved Sentry issues for me.
The agent does exactly that. It pulls the error report through MCP,
reads the description, and executes the suggested fix: an
npx command that downloads a package from npm and runs it
with your permissions. Throughout the process, the agent shows no signs
of anything unusual. The terminal output looks identical to a normal bug
fix.
What you don’t know is that this error report wasn’t generated by
your application crashing. It came from a stranger, submitted casually
using the Sentry DSN publicly embedded in your website’s frontend
JavaScript. The fix suggested in the report wasn’t a diagnostic
recommendation generated by Sentry either — it was markdown written by
the attacker, disguised as a code block under a
## Resolution heading. Your agent fell for it. Its next
action wasn’t fixing a bug. It was probing ~/.aws/config,
~/.npmrc, and ~/.docker/config.json on your
machine, sending the existence of credential files to the attacker’s
server.
This is not a hypothetical scenario. On June 12, 2026, Tenet Security publicly disclosed this attack, named Agentjacking (original blog). Controlled testing covered over 100 AI coding agent instances across Claude Code, Cursor, and Codex — the three most widely used tools — with 85% of attack attempts successfully executing malicious code. Passive reconnaissance found 2,388 organizations with exposed, injectable DSNs, 71 of which rank in the Tranco global top one million. Victims ranged from a Fortune 500 giant with a market cap of roughly $250 billion down to independent solo developers.
Every step in the attack chain is a legitimate operation, requiring no bypass of any security product. Tenet calls this the Authorized Intent Chain: EDR, WAF, IAM, VPN, Cloudflare, and firewalls all go blind because every action is authorized and there is nothing malicious to detect.