Agentjacking: how a fake error message takes over AI agents

AI agents read error messages, web pages, emails and tickets. And they can act: run commands, install packages, change code. As soon as both come together, every text they read becomes a possible command. In 2026, security researchers showed several attacks that exploit exactly this. Three of them are particularly instructive.

Agentjacking via Sentry

Sentry is a widely used service that collects errors from websites and apps. So that a website can report errors, a key sits in the public JavaScript, the so-called DSN. With it, anyone can submit error messages. For a long time that was harmless.

In June 2026, Tenet Security showed why it no longer is. The sequence:

1. The attacker reads the DSN from a website's public code.
2. They send a fake error message. It looks like a real diagnosis, with headings, code blocks and a section “How to fix the error”. It contains an npm command.
3. A developer asks their coding agent to look at the open errors. The agent reads them through the Sentry MCP server.
4. The agent takes the command for the solution and runs it. The package searches for environment variables, cloud credentials, Git credentials and private repositories.

According to an analysis by the Cloud Security Alliance, Claude Code, Cursor and Codex could not tell the fake messages from real ones in testing. The attack worked in 85 percent of cases. At least 2,388 organisations had DSNs that could be abused this way, publicly in JavaScript or on GitHub. This is research under controlled conditions. Broad attacks in the wild have not been confirmed so far.

Instructions in HTTP headers

In October 2026, the security firm Signals Corps analysed 217 million page requests from Common Crawl. 30 websites hid instructions for AI agents in their HTTP headers. No visitor sees these headers; they are part of the server's technical response. Most of the attempts were jokes. One targeted AI systems that pre-sort job applications and reported a “94% match”.

Only an agent that reads the headers at all is affected. That depends on the tool. Some browser tools for agents return the full headers by default. The lesson: prompt injection is not only in the visible text.

Mini Shai-Hulud: malicious code in the agent configuration

Shai-Hulud is a family of worms in the npm ecosystem. They steal developers' credentials and use them to publish infected versions of further packages. The variant Mini Shai-Hulud from May 2026 went one step further. According to the Cloud Security Alliance, it was the first known attack that used the configuration files of AI coding agents to persist. The worm wrote hooks into the settings of Claude Code and VS Code. These hooks run along with every action of the agent. Affected packages included some from the TanStack namespace, from UiPath and from Mistral AI.

So the configuration of an agent is an attack surface. If you have many hooks and skills that nobody looks at any more, you won't notice one more. That is also why we clean up the setup at every model change. More on this in the article New AI model? Delete everything first.

The common pattern

All three attacks work the same way. An agent reads content controlled by a stranger. It cannot reliably tell it apart from instructions from its user. And it has the permissions to do something dangerous. If one of these three conditions is missing, the attack fails. That is exactly where the guardrails come in.

Guardrails against agentjacking

1. Outside content is data. Error messages, tickets, web pages and headers can come from strangers. The agent may draw information from them, but not commands.
2. Require approval for commands and installations. Shell commands, new packages and network access run only after confirmation by a human. That costs seconds and prevents the core of these attacks.
3. Let agents work without credentials. The agent runs in a sandbox with no cloud keys, no production data and no access to private repositories it doesn't need.
4. Approve MCP servers deliberately. Every server is a door to the outside. Only servers from a fixed list, with as few permissions as possible.
5. Check configuration in review. Changes to agent settings, hooks and skills belong in the same review as code. A new line in a settings file is not a detail.
6. Limit public keys. Rotate Sentry DSNs if they are abused, and filter incoming reports.

Frequently asked questions