← Notes & write-ups

The error report that ran code: what Agentjacking taught me about distrusting my own logs

27 June 2026· 6 min read

My first two write-ups circled the same quiet idea without ever naming it: security lives on a seam between data and instructions, and most of defence is just deciding what you are willing to trust. One post was about an AI agent walking an attacker across localhost — a boundary that turned out to describe geography rather than trust. The other was about reading a third of a million failed logins and learning that defence is structural: reduce what is reachable, then watch. This month a new story made me realise those two posts were about the same crack, and that I had still drawn my trust line in the wrong place.

In mid-June 2026, a startup called Tenet Security disclosed an attack it named Agentjacking (Tenet Security; covered by The Hacker News and The New Stack). The setup is almost insultingly simple. Sentry, the error-tracking tool that sits inside a huge share of production apps, accepts error events from anyone who holds the project’s DSN, and that DSN is a public key that ships in the front-end source of the very sites it monitors. Separately, teams now wire Sentry into their AI coding agents through an MCP server, so the agent can read recent errors and help fix them. Put those two facts together and an attacker can post a fake error whose text is written to look exactly like Sentry’s own “suggested resolution steps.” The agent, whether that is Claude Code, Cursor or Codex, reads it as trusted diagnostic output and runs the attacker’s commands. No exploit, no memory corruption. Just text the machine was told to believe.

I want to be precise about scale, because the numbers are the unsettling part, not the mechanism. Tenet found 2,388 organisations exposing injectable DSNs through nothing but passive reconnaissance, 71 of them in the Tranco top-1M list of busiest sites. Across controlled tests, more than 100 real AI coding agents acted on the injected errors, with a reported 85% exploitation success rate. That number is Tenet’s own, from a vendor selling the fix for it, and the methodology is not published. I use it as a direction, not a measurement. A successful run hands over environment variables, Git credentials, private repository URLs, which is the developer’s keys to everything. Tenet disclosed to Sentry on 3 June 2026; Sentry added a content filter for the proof-of-concept payload, and Tenet shipped hardening configs it calls agent-jackstop. As a single bug, it is being closed. As a pattern, it has barely started.

Here is what I had wrong, and I suspect I am not alone. After AutoJack I had updated my mental model to distrust what the agent browses: web pages, the untrusted internet. Agentjacking distrusts something I would never have put on the list: my own error log. For decades a stack trace was the most trusted text in engineering, because it had one defining property. We wrote it for ourselves. We did name this once. Log injection is CWE-117, and it has been in OWASP guidance since the 2000s. But CWE-117 assumes the victim is a person reading a log viewer, misled about what happened. What is new is a reader that does not merely display the line. It runs it. An AI agent breaks that property twice over: it reads that “internal” data on our behalf, and it can act on it. The seam from my first post is back, but the dangerous input is not the obvious hostile web page. It is the operational exhaust we generate and trust by reflex: logs, errors, tickets, CI output, monitoring. The real attack surface of an agent is everything it reads in order to be helpful.

What makes this land for me is the symmetry with my own server logs. In that earlier post a log line was a signal, something I read to notice an attack and harden the door. Agentjacking is the same artifact, a log, read instead by a machine that can pull a trigger. The exact same data is a defence when a careful human reads it and a weapon when an eager deputy can execute it. The thing that changed is not the data; it is that we handed the reading, and the hands, to something that cannot tell a description of an action from an instruction to take it.

This is not an isolated research toy, either. A month earlier Google’s threat team described the first cybercrime case where an actor used an AI model to help discover and weaponise a zero-day — a 2FA-bypass whose code carried the tells of machine authorship, down to a hallucinated CVSS score (Google Threat Intelligence, via SecurityWeek). Offence is automating the expensive half of an attack, while defence is wiring fast, trusting agents into the centre of its own toolchain. The two trends point straight at each other.

Where does that leave the person on the other side? You cannot patch the fact that the agent believed its inputs. That is the design. You move the boundary outward to something that does not read English: least privilege and strict allowlists on every command an agent can run; treat all ingested data as untrusted even when you generated it; require real authentication on the channels that feed an agent. Sentry’s filter and Tenet’s agent-jackstop help, but they bound the blast radius rather than removing it. The cleanest rule I have found is still Meta’s Agents Rule of Two: never let one agent session hold untrusted input, private data, and the ability to act, all at once (Meta). Agentjacking is precisely what happens when it holds all three.

Nothing new is required to think about this. The oldest mistake in security, confusing input with instructions, came back wearing the friendliest possible disguise: a helpful assistant reading my own bug reports. My first post trusted a door because of where it stood; my second learned to watch the door; this one is about realising the agent will happily read a note slipped under it and do what the note says. The walls are the ones we have always had to build by hand. What is new is that we finally have to build them around the data we wrote for ourselves.

Sources / Nguồn:
- Tenet Security — Agentjacking disclosure (primary): tenetsecurity.ai
- The Hacker News — “Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code” (June 2026): thehackernews.com
- The New Stack — “A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex”: thenewstack.io
- Google Threat Intelligence Group — AI-assisted vulnerability exploitation (12 May 2026): cloud.google.com
- SecurityWeek — “Google Detects First AI-Generated Zero-Day Exploit” (11 May 2026): securityweek.com
- Meta — “Agents Rule of Two”, practical AI agent security: ai.meta.com

PreviousAutoJack and the wall that was never there: what a first-year defender lNextWhen bugs became free: the week defending itself became the attack surfa