Tracing the ghost coins back to the genesis block.
On June 3, 2026, a single HTTP POST containing a malformed JSON payload reached a public Sentry endpoint. No zero-day, no brute force, no social engineering. That POST, directed at a DSN leaked in a public GitHub repo, triggered a chain of events that ended with an attacker holding AWS credentials, GitHub OAuth tokens, and npm registry access—all harvested from a developer’s machine. The attacker didn’t hack the developer. They hacked the developer’s AI coding agent.
Every transaction leaves a scar on the ledger.
I’ve spent the last decade tracing on-chain transactions, forensic audits of ICO whitepapers, and mapping liquidity flows. The same principle applies here: every data flow in a connected system leaves a trail. The problem is that most developers treat error monitoring tools like Sentry as passive infrastructure—a dark corner where logs go to die. Tenet Security’s DEF CON 34 presentation, “Agentjacking,” reveals that these passive corners have become active attack surfaces. The attack vector is not a vulnerability in the AI model itself, but a combinatorial flaw in the architecture of AI coding agents.
Here’s the context. Sentry’s public DSN (Data Source Name) is a key that allows anyone to send error events to a project’s stream. By design, no authentication is required for the POST endpoint—anyone can push a new issue. Meanwhile, AI coding agents like Claude Code and Cursor now integrate with Sentry via the Model Context Protocol (MCP). When a developer asks the agent to debug a Sentry error, the agent fetches the issue data, including the issue’s description, stack trace, and any markdown content. That markdown is where the attack lives.
The liquidity pool is a mirror, not a reservoir.
The attack chain is brutally simple. Step one: an attacker discovers a public DSN—2,388 such organizations are publicly findable, with 71 belonging to sites in the Tranco top 1 million. Step two: the attacker sends a POST to that DSN, creating a fake error issue with a markdown body that contains a “fix suggestion.” The suggestion instructs the agent to run npm install a malicious package. Step three: a developer triggers the agent to fetch and resolve that Sentry issue. Step four: the agent reads the markdown, interprets the “fix” as a legitimate instruction, and executes the npm install command. The malicious package then exfiltrates credentials from the developer’s environment.
Tenet’s controlled test across 100+ organizations reported an 85% success rate. The attack does not require the model to jailbreak or bypass alignment—it exploits the default trust between the agent and its tool outputs. The MCP layer treats the Sentry issue data as neutral context, not as foreign code. The model has no semantic mechanism to distinguish between a genuine bug report and an attacker’s payload.
Core insight: the attack is a composition of three individually benign design choices.
First, Sentry’s unauthenticated POST endpoint is a deliberate choice for low-friction error ingestion. Second, the MCP integration allows agents to read and act on that data. Third, the agent’s default behavior is to execute code fixes suggested by its tools. Each choice is defensible in isolation. Together, they create a gap wide enough to drive a credential theft through.
What the data shows is that the attack surface is not hypothetical. The 2,388 exposed DSNs represent a pool of potential targets. Of those, 71 are from high-traffic websites. Cloudflare’s MCP integration alone exposes about 27% of Fortune 1000 companies—meaning an attacker can target a specific organization by finding its public DSN and crafting a payload tailored to its tech stack. The attack is scalable and automated: a single HTTP POST per target, no follow-up required until a developer triggers the agent.
Contrarian angle: the fix is not the fix.
Sentry’s response was to deploy a content filter blocking specific payload strings. Tenet released agent-jackstop, a drop-in configuration that enforces network egress whitelists, command approval, and subprocess-level credential isolation. Both are band-aids, not root cause solutions. The content filter is a string blacklist—trivially bypassable with obfuscation. Agent-jackstop reduces the blast radius but does not change the fundamental architecture: the agent still cannot distinguish data from instructions. The “fix” becomes a cat-and-mouse game.
Based on my 2017 ICO audits, I learned that narrative value often diverges from technical reality. The narrative here is that “AI agents are safe because they run locally.” The technical reality is that the trust boundary has shifted from the model to the data sources it consumes. Every public DSN is a potential backdoor. Every MCP-connected tool is a potential injection point. The industry’s emphasis on model alignment—RLHF, safety training, instruction hierarchies—has missed the real gap: the semantic layer between the agent and its tools.
Takeaway: the next wave of security will be about data source trust, not model trust.
For crypto projects, which rely heavily on AI coding assistants for smart contract development, this is a critical risk. A compromised agent could introduce a backdoor into a DeFi protocol, or exfiltrate private keys stored in environment variables. The attack does not require nation-state resources—just a public DSN and a developer who asks their agent to debug an error.
The question for every engineering team is not whether your agent is safe, but whether your data sources are trusted. The on-chain analogy is clear: you wouldn’t sign a transaction from an untrusted wallet. You shouldn’t let your agent execute code from an untrusted error log.
Tracing the ghost coins back to the genesis block.
The attack chain I’ve described is a new variant of an old problem: trust in input. In the 1990s, it was SQL injection. In the 2010s, it was prompt injection. In 2026, it’s agentjacking. The pattern is the same—the system trusts the data it receives, and the attacker exploits that trust. The difference is that AI agents make decisions based on that data, and those decisions have real-world consequences.
I’ll be watching the MCP protocol evolution closely. If the standard adds a required “trust level” field for tool outputs, that would be a sign of systemic learning. If not, we’ll see more attacks like this, and the cost will be measured in lost credentials, compromised codebases, and eroded trust in AI-assisted development.