The data shows: 2,388 organizations have publicly exposed Sentry DSNs. 71 of those are in the top 1 million websites. 27% of Fortune 1000 companies are reachable through Cloudflare's MCP integration. This is not a vulnerability. It is an architecture gap.
Let me quantify the chaos. Then reveal the pattern.
Context: The Trust Boundary of AI Coding Agents
Sentry is a crash reporting platform. Developers embed a public DSN (Data Source Name) into their frontend code to capture errors. The DSN is not a secret—it is designed to be public. But the endpoint that accepts error reports is unauthenticated. Any HTTP POST with a valid DSN will be accepted.
Now enter AI coding agents. Claude Code, Cursor—these tools use the Model Context Protocol (MCP) to connect to external services. One common MCP server is the Sentry integration. A developer asks the agent: "Why is this error happening?" The agent queries Sentry via MCP, fetches the latest issue, and reads the error context.
That context is markdown. And the agent treats it as instructions.
Core: The Attack Chain – Six Steps, No Exploits
- Reconnaissance: Attackers scan public GitHub repositories for hardcoded Sentry DSNs. Tenet Security found 2,388 organizations with exposed DSNs, including 71 in the Tranco top 1 million.
- Inject: A single HTTP POST to Sentry's unauthenticated endpoint with a malicious error event. The payload contains markdown disguised as a "fix suggestion."
- Trigger: The developer—unaware—asks the AI agent to investigate a Sentry error. The agent fetches the attacker's crafted issue.
- Execute: The agent interprets the markdown as a repair instruction. It runs
npm install agentjack—a malicious package hosted on npm. - Escalate: The malicious package exfiltrates credentials: AWS keys, GitHub OAuth tokens, npm registry tokens, Docker registry tokens.
- Persist: The attacker now has access to the developer's machine and the organization's internal tooling.
Tenet demonstrated this chain at DEF CON 34 with a reported 85% success rate across 100+ organizations. The attack is not a zero-day. It is a known technique—indirect prompt injection—combined with public-by-design infrastructure.
From my audit experience in 2018, I recognized the pattern. During the Compound Finance audit, I saw that trust boundaries were the weakest link. The lending protocol assumed that price feeds were correct. Here, the AI agent assumes that Sentry data is safe. Both assumptions are wrong.
Data that matters:
- 2,388 organizations with public DSNs (Tenet scan)
- 71 of those in Tranco top 1 million
- ~27% of Fortune 1000 reachable via Cloudflare MCP (estimated)
- 6-step attack chain, no CVE required
- 85% success rate in controlled test
Contrarian: The Real Problem Is Not the Agent
The narrative is "AI agents are vulnerable to prompt injection." That is a half-truth. The ledger never lies, only the interpreter does. The agent is just the interpreter. The real vulnerability lies in the system design: connecting an agent to an untrusted data source without a sandbox.
Consider: Sentry's DSN endpoint is unauthenticated by design. That is intentional. It allows anyone to report errors. But the MCP protocol has no mechanism to distinguish "data" from "instructions." The agent cannot tell if the markdown content is a real error or a planted command.
Correlation ≠ causation. The attack is not a failure of the AI model. It is a failure of the orchestration layer. The same risk exists in any system that consumes external data and acts on it. DeFi oracles had the same problem in 2020. I wrote a Python script to scrape on-chain data and model stablecoin health. The lesson: trust the data source, not the data.
The Counter-Intuitive Angle: The mitigation strategies proposed—content filters, network whitelists, command approval—are all reactive. Sentry deployed a content filter for specific payload strings. That is a regex band-aid. Tenet's agent-jackstop tool adds end-side policy enforcement: network egress whitelist, command approval, subprocess credential protection. These reduce the blast radius but do not fix the root cause: the MCP data path is a trust highway.
Code is law, but data is truth. In this case, the data is a lie. The only way to fix this is to change the protocol: require a "trust signature" on every tool output, or enforce instruction hierarchy in the model training.
Takeaway: The Next Signal
This event is a warning shot. AI coding agents are being adopted faster than their security models mature. The next week's signal: watch for MCP security extension proposals. Will Anthropic add a data integrity layer to the protocol? Will Cloudflare offer content sanitization on its MCP server? Or will the market wait until the first major credential theft makes headlines?
Yield is a function of risk, not magic. The risk here is real, quantifiable, and addressable. The question is whether the industry will treat it as a priority or a footnote.
Every transaction leaves a shadow in the block. This attack leaves a shadow in the error log. The shadows are there. We just need to read them.
