2,388 public Sentry DSNs. 71 in the top 1 million websites. 27% of Fortune 1000 companies exposed. The numbers don't lie.
I've seen this pattern before. In 2020, I analyzed Compound Finance's liquidity inflows. The lesson was the same: trust boundaries matter. On-chain, we call it a reentrancy attack. Here, it's the same violation — but the asset is not funds, it's credentials. AWS keys. GitHub tokens. npm registry secrets.
The attack surface is real. And it's not a bug in the model. It's a bug in the architecture.
Context: The Pieces on the Board
Sentry is an error monitoring platform. Developers integrate it into their apps via a DSN — a public key that identifies the project. The DSN is meant to be public. You can POST error events to Sentry's ingest endpoint without authentication. That's by design.
MCP, or Model Context Protocol, is an open standard championed by Anthropic. It allows AI agents — like Claude Code or Cursor — to talk to external tools. Sentry has an MCP server. When a developer asks their agent to debug a crash, the agent queries Sentry, pulls the error context, and suggests a fix.
That's the trust chain: developer → agent → MCP → Sentry → error data.
The chain is fragile.
Core: The Attack Chain — Step by Step
Tenet Security, a firm specializing in AI agent security, demonstrated the exploit at DEF CON 34. Here's the attack chain, reconstructed from the data:
Step 1: Discover public DSNs. Tenet scanned the internet. They found 2,388 organizations with publicly exposed Sentry DSNs. 71 of those belonged to sites in the Tranco top 1 million. 27% of Fortune 1000 companies, they estimate, are vulnerable through Cloudflare's MCP integration.
Step 2: POST malicious error events. The attacker sends a crafted error event to the Sentry ingest endpoint. The DSN is valid. The event is accepted. The payload contains a markdown-formatted "fix suggestion" — an indirect prompt injection.
Step 3: Developer triggers the agent. A developer encounters a real crash. They ask their AI coding agent to check Sentry for details. The agent queries the MCP server, which returns the attacker's injected event.
Step 4: Agent interprets markdown as instructions. The agent sees the fix suggestion. It treats the markdown as a legitimate instruction. The prompt injection is not a jailbreak — it's a trusted data source being used as a command channel.
Step 5: Execute malicious npm install. The injected suggestion tells the agent to run npm install malicious-package to "fix the issue." The agent executes it. The package contains a postinstall script that steals credentials.
Step 6: Credentials exfiltrated. The script reads AWS keys, GitHub tokens, npm registry secrets, Docker configs, shell history, SSH keys — all stored on the developer's machine. The attacker now has a foothold.
Tenet claims 85% success rate in controlled tests across 100+ organizations. That's a high bar. But even if the real-world rate is lower, the attack is viable. The chain is closed. The exploit is not theoretical.
Trace the data flow. Trust boundary: breached.
Contrarian: The Real Vulnerability Is Not Sentry
Sentry is not the villain. The DSN model is public by design. The ingest endpoint is open. That's not a bug.
The real vulnerability is architectural: AI agents cannot distinguish data from instructions.
When an agent reads a Sentry issue, it sees a string of text. The text might contain a command. The agent has no semantic layer to separate "this is a crash report" from "this is a patch suggestion." The model treats all context as equal.
This is not a prompt injection in the traditional sense. It's a trust boundary violation. The agent trusts the MCP server. The MCP server trusts Sentry. Sentry trusts any POST with a valid DSN. The chain has no verification. No signature. No provenance.
The mitigations are patches, not cures. Sentry deployed a content filter that blocks specific payload strings. That's an IoC-level blacklist. It can be bypassed with simple encoding. Tenet released agent-jackstop — a tool that applies network egress whitelists, command approval, and subprocess-level credential protection. These reduce the blast radius. They do not fix the root cause.
The root cause is that the MCP protocol does not require a trustworthiness declaration for data sources. There is no standard for marking content as "user input" vs "system output" vs "external data." The model has no mechanism to treat tool output as potentially adversarial.
I've seen this in DeFi. Composability without security boundaries leads to hacks. The same principle applies here.
The Industry Impact: A Brake on AI Agent Adoption
This event is a brake on the adoption curve. Enterprise security teams will now classify "agent reading external data sources" as high risk. They will demand network isolation, command approval, and credential vaulting.
MCP ecosystem shifts from feature race to security race. Public MCP servers will need to provide trust scores, audit trails, and data provenance. The protocol itself may need a security extension layer — a way for tools to declare the trustworthiness of their output.
Error monitoring SaaS faces a trust reset. Sentry's refusal to do a platform-level fix — calling it "technically not feasible" — is a signal. The company is choosing cost over security. Customers will notice. Alternatives like self-hosted OpenTelemetry with a signed ingest gateway will gain traction.
Agent security is a new category. Tenet is positioning itself as the leader. Agent-jackstop is a free tool. But the business model is enterprise-grade: SSO, policy management, audit logging. The market is real. The attack surface is quantifiable. The demand is rising.
Takeaway: Trustless Verification for Agent Inputs
The next 12 months will define how agents handle external data. We need a protocol-level solution: a way for tools to cryptographically sign their output, for agents to verify provenance, and for models to treat tool output as untrusted until proven otherwise.
Until then, every AI coding agent is a potential exploit vector. Watch the MCP security extensions. Watch the funding rounds for agent security startups. The numbers don't lie.
Floor broken. Trust drained. Attack surface: exposed.
The data speaks. Listen closely.