Agentjacking attack hides commands in fake Sentry errors to hijack Claude Code

The attack, publicised by Tenet Security and reported by The Hacker News on June 12, is called "agentjacking". According to Tenet Security, attackers place commands inside the Resolution section of a Sentry issue, and a coding agent that reads that section will execute them. The attacker never has to touch the target's code repository or any account. In one typical scenario a developer asks a coding agent to fix unresolved Sentry issues; the agent calls Sentry, opens the top issue, finds a tidy section headed Resolution containing a single command in a code block, and runs it. The person who wrote that command has had no contact with the repository or the account.

Tenet Security says it identified 2388 organisations whose Sentry DSNs could be injected. In controlled testing across more than 100 organisations, the success rate reached 85 percent, and Claude Code, Cursor and Codex were all tricked into executing the injected commands. The report stresses that the whole execution happens inside the agent's reading and running step: the attacker does not need to breach the target's repository or its accounts.