Agentjacking attack hits nearly 2,400 organizations
Researchers found an attack that abuses the Sentry error-tracking tool to make AI coding agents run malicious code, with an 85 percent success rate.
- A new attack called agentjacking abuses Sentry, a popular error-tracking tool, to trick AI coding agents.
- It hit 2,388 organizations that use agents like Claude Code and Cursor.
- The successful exploitation rate reached a striking 85 percent.
- The attack makes an agent run malicious code during entirely routine work.
What happens when the tool you trust to report your bugs becomes the one that attacks you? That is exactly where a new attack hurts, one that security researchers have named agentjacking. Instead of cracking passwords or hunting for a hole in a server, it targets something newer, the AI coding agents that more and more developers let work on their own.
The mechanism is uncomfortably simple. Sentry is a tool that catches errors in an app and produces a tidy report on what broke. An AI agent like Claude Code or Cursor reads that report as part of its job, so it can understand the problem and suggest a fix. The attack plants hidden instructions inside those very error reports. The agent reads them, treats them as a legitimate task, and runs malicious code, all during work that looks completely normal.
The numbers are what set this story apart. Researchers counted 2,388 affected organizations, and the exploitation success rate was 85 percent. This is not a fringe flaw that works in a lab and falls apart in practice. It is an attack that lands in almost nine out of ten attempts.
How exactly does the attack fool the agent?
The whole idea leans on a habit we introduced ourselves. We give an AI agent access to tools and tell it to freely read data from them, because that solves problems faster. To the agent, a Sentry error report is just one more piece of text to process. The trouble is that the agent draws no clear line between the data it reads and the commands it should run.
So the attacker writes a sentence into the error report that sounds like an instruction. To a human reading the log, it is a suspicious line of text. To an agent trained to be helpful, it easily becomes a task. That is where the damage happens, because the agent often has the power to change files, run commands, or reach other systems.
It is worth saying what this is not. It is not a flaw in Claude Code or Cursor themselves in the classic sense, nor a virus that spreads on its own. It is about the way we wire trusted tools to agents that have too much freedom and too little checking of what is really a command.
What to do if you use these tools
First, narrow the agent’s permissions. If the agent does not need the right to run arbitrary commands on the system, take it away. Our recommendation is the principle of least privilege, where the agent gets exactly as much access as the task needs and not one step more.
Second, treat content from external tools as untrusted, even when it comes from a tool you normally trust. An error report is data, not a command. If your team builds its own agent workflows, it is worth adding a layer that clearly separates what the agent reads from what it is allowed to run.
Third, turn on review-before-execution for anything the agent does in sensitive places. Yes, that slows the work down. But an 85 percent success rate is reason enough to accept a little less convenience for a moment.
This discovery arrives just as teams push autonomous AI agents into software development at a faster and faster pace. The race for speed is understandable, but every new tool the agent trusts also becomes a new door someone can walk through. How much do you really know about what your AI agent is allowed to do without your approval?
