Agentjacking vulnerability exposes Claude Code and Cursor to hijacking via fake error reports

Researchers at Tenet Security found a way to compromise AI agents using the Model Context Protocol. The attack requires no malware, as the agent itself executes the attacker’s code with developer privileges.

The technique relies on spoofing data in Sentry. The attacker sends a fake report with a malicious command in the Resolution field. Agents connected to Sentry via MCP interpret this text as a trusted instruction and execute it in the terminal.

In tests, the vulnerability worked 85% of the time for Claude Code and Cursor. The attack gives access to environment variables, AWS keys, and GitHub tokens. It bypasses EDR and firewalls, as the agent’s actions are formally authorized by the user. Sentry addressed the issue with string filtering rather than fundamental changes.