DEF CON 34's 85% Agentjacking Hit Rate Starts With One Public Sentry DSN

DEF CON 34 highlighted a new trust path from Sentry into developer environments

At DEF CON 34, Sentry shifted from an error-monitoring tool to an injection channel for AI coding agents. Tenet Security showed that a public Sentry DSN is enough to push malicious instructions into error streams, and testing across Claude Code, Cursor, and OpenAI's CLI showed an 85% exploitation success rate. That makes the issue more than a niche configuration mistake; it is a new trust path into developer workflows.

Why the 85% figure matters

The bigger signal is scale. Researchers identified at least 2,388 organizations with publicly exposed DSNs, so the surface is already aggregated and searchable before any specific target is chosen. An 85% success rate across major coding agents suggests the market has normalized a workflow that treats monitoring data as harmless.

Why this matters now

What gets demonstrated at Hacker Summer Camp often moves quickly from concept to weapon. DEF CON 34 also broadened the pattern beyond Sentry: agent attack surface is becoming a central security concern. If your stack lets agents query Sentry, Jira, or similar services, the immediate question is whether those tools are helping developers or silently widening the breach path.

The attack works because data is being treated as instruction

The trust break in one step

The tooling did not change; the trust assumption did. Sentry accepts arbitrary payloads from anyone with the DSN, and the Sentry MCP server then returns that data to AI agents as trusted system output. In other words, the rupture is simple: data becomes instruction because the agent treats the service response as authoritative guidance.

Why traditional controls can miss it

That trust break explains why the exploit rate was so high. Across Claude Code, Cursor, and OpenAI Codex CLI, attackers achieved an 85% exploitation success rate. Agents retrieved injected events and ran attacker-supplied commands under the developer's own privileges, with no malware changes hands. Traditional controls focused on unauthorized access, stolen credentials, or bad binaries can still miss an attack that travels through authorized tool use.

Tenet's framing is straightforward: the agent is the attack surface now. Defenders can struggle to spot this because the agent is acting with legitimate intent under a real developer identity.

What to audit first if agents can query Sentry or similar services

Map the agent's external trust paths

The first step is inventory: list every external service an agent is allowed to query. The risk is not only a public DSN; it is the implicit trust placed in whatever those services return. From there, pressure-test whether your stack can stop authorized-but-hostile instruction chains. The DEF CON takeaway was blunt: every call in the chain was allowed.

Why vendor response matters

Sentry's response matters because the platform refuses to fix the root cause. Even if the immediate flaw is framed as a configuration or design choice, the broader risk is that MCP-based tooling still treats service output as actionable guidance without tighter execution controls. That creates vendor-credibility risk as well as operational risk.

The broader exposure signal

The broader exposure signal is 8,000+ exposed MCP servers. If that surface is live in your environment, the conversation shifts from theory to scoping: which agents can reach public-toward-the-agent tools, and what happens if the responses from those tools contain instructions rather than just data.

What likely gains traction

• MCP gateway controls that separate data from instructions
• Audit logging across agent tool calls so authorized decisions are traceable
• Execution sandboxes and approval gates for privileged actions
• SaaS error-monitoring vendors that tighten write policies and response parsing

That list matters because per-agent least privilege does not automatically stop one agent from arranging harmful outcomes through other authorized tools.

What would weaken this thesis

This risk loses relevance if vendors tighten how publicly writable services are consumed by agents, or if organizations prove that human approval and stricter execution boundaries meaningfully block authorized-but-hostile instruction chains. Until then, the priority is safer execution and better visibility, not just faster deployment.