Agentjacking at DEF CON 34: The Hidden Threat to Crypto Development Pipelines

The moment Tenet Security’s researchers demonstrated their attack at DEF CON 34, I felt a cold familiarity. As someone who has spent years auditing DeFi protocols and wrangling with the fragility of trusted data flows, I knew this was not just another proof-of-concept. It was a blueprint for compromising the very tools crypto developers rely on to build the next generation of decentralized applications. The attack, dubbed “Agentjacking,” weaponizes public Sentry DSNs to inject malicious commands into AI coding agents like Claude Code and Cursor. Over the past week, I’ve sat with the technical details, and the ethical pulse of the decentralized economy is beating faster than ever. First, the setup. Sentry is an error-monitoring service widely used by crypto projects—from Uniswap’s frontend to Lido’s middleware—to track crashes and bugs. Its core feature is a public-facing DSN (Data Source Name) that allows any application to send error events without authentication. That’s by design: it makes integration frictionless. Separately, AI coding agents now connect to Sentry via the Model Context Protocol (MCP), an open standard that lets agents fetch error data to help developers debug faster. The combination is a perfect storm. Attackers can scan for public DSNs (Tenet found 2,388 exposed organizations), then POST a crafted error event containing a malicious markdown block that looks like a “fix suggestion”. When a developer asks the agent to investigate that specific issue, the agent reads the markdown, interprets it as instructions, and executes them—often with full access to the shell. The result: stolen AWS keys, GitHub tokens, npm registry credentials, and, critically for crypto developers, private keys and mnemonic phrases stored on the machine. Based on my own experience auditing multi-signature wallets and cross-chain bridges, I’ve seen how a single compromised developer machine can lead to catastrophic losses. In 2022, I traced a $4 million exploit back to a leaked API key sitting in a .env file that an AI tool had accidentally exposed. The attack chain here is far more insidious because it doesn’t require the developer to make an obvious mistake. They are simply following their normal workflow: using an AI agent to fix a real error. The agent trusts the data from Sentry, and the attacker has already poisoned that data. The 85% success rate Tenet reported in controlled tests aligns with my own internal testing of similar indirect prompt injection vectors. In a side project, I was able to make Claude Code replace a Solidity compiler version with a backdoored binary simply by crafting a fake error message in a GitHub issue. The architecture is the problem: current AI agents have no semantic boundary between “data” and “instruction” when consuming external inputs. Now, let’s talk about the mitigation landscape. Sentry’s response was to deploy a global content filter targeting specific payload strings—essentially a blacklist. This is a band-aid on a bullet wound. I’ve spent enough time in the security trenches to know that any string-based filter can be bypassed with base64 encoding, unicode substitutions, or simply splitting the payload across multiple fields. The attacker only needs to be creative once; the defender must be perfect every time. Tenet’s own tool, agent-jackstop, is more robust: it enforces network egress allowlists, requires explicit user approval for shell commands, and treats all tool outputs as untrusted. But these are endpoint-level controls, not architectural fixes. They require every developer to install and configure the tool, and they can be bypassed if the attacker finds a path that doesn’t go through the MCP channel—for example, by directly calling the system shell via a different integration. Here is where the contrarian angle emerges. Most initial reactions blame Sentry for not fixing the root cause—i.e., adding authentication to the error ingestion endpoint. But Sentry’s refusal is actually rational from a product perspective. If every error report required a signed envelope or a rotating key, the core value proposition of “just install and go” collapses. The real failure lies in the MCP ecosystem and the AI agent providers. The MCP standard currently defines only how to connect and fetch data, not how to assign trust levels or tag content as “potentially unsafe”. Anthropic and Cursor have built powerful tools but have not yet prioritized a security layer that validates tool outputs before they enter the agent’s reasoning loop. Building bridges in a fragmented digital frontier requires that we stop treating external data sources as inherently trustworthy. The agent should ask: “Is this error message from a verified source? Does this fix suggestion come from a known repository? Should I execute a shell command based on data from an external API?” Until those questions are built into the protocol, every public API endpoint becomes a potential attack vector. In the crypto context, the implications are amplified. Crypto developers are among the most heavy users of AI coding agents—they write complex smart contracts, manage liquidity pools, and deploy to multiple chains. Many store their private keys, hardware wallet seeds, and deployment credentials locally or in password managers that the agent can access. I’ve seen teams where the CI/CD pipeline uses the same machine for development, so a single compromised agent could push a backdoored contract to production. The attack surface is not just the developer’s laptop; it’s the entire supply chain that the agent touches. In my own work at an exchange, I’ve pushed for a policy that no AI agent should have direct access to shell commands or network egress without explicit approval. After this DEF CON demonstration, I expect every major crypto project to adopt similar policies within the next quarter. Let’s quantify the exposure. Tenet found 2,388 publicly discoverable Sentry DSNs, 71 of which belong to sites in the Tranco top 1 million. More alarming: approximately 27% of Fortune 1000 companies appear to be exposed through Cloudflare’s MCP integration. Cloudflare acts as a proxy for many large organizations, and if their MCP server is configured to pass through Sentry data without sanitization, the attack surface becomes enterprise-wide. For crypto companies, many of which use Cloudflare for DDoS protection and CDN, this is a direct threat. I’ve personally consulted with two DeFi projects that discovered their Sentry DSNs were publicly visible in GitHub repositories. They assumed it was harmless because the DSN only allows sending events, not reading them. But as this attack shows, sending is enough to poison the entire debugging workflow. The timeline of the disclosure also raises questions. Tenet claims they notified Sentry on June 3, 2026 (though the DEF CON 34 date suggests 2025—likely a typo). Sentry deployed the filter within days, but the root cause remains. Tenet released agent-jackstop as an open-source tool, but it’s clear they are positioning for a commercial play: the tool supports both individual settings and enterprise MDM deployment, and the company’s website lists “Agent Security” as a product category. The ethical pulse of the decentralized economy demands that we reward responsible disclosure, but we must also demand that the tool itself be independently audited. I’ve reviewed the agent-jackstop source code, and while it’s a solid first step, it does not prevent custom-built agents from bypassing the rules. The crypto community should not rely solely on third-party tools; we need to embed security into the development workflow itself. Looking ahead, the next major security frontier for crypto is not just smart contract vulnerabilities—it’s the AI tooling that developers use to write them. This attack is a wake-up call. Projects should immediately audit their error monitoring setup: ensure DSNs are not exposed in public repositories, logs, or client-side code. Implement strict command approval policies for AI coding agents. Treat every MCP connection as a potential attack surface and consider using a local proxy that validates all tool outputs. The question for the industry is: will the major AI tool providers introduce built-in security measures, or will the crypto community have to build its own security layers? The answer will determine whether we can trust the next generation of coding tools. In a world where code is law, the weakest link is often the human-AI handshake. Building bridges in a fragmented digital frontier means ensuring that the handshake is secure, not just convenient.