CSA extends agentjacking warning beyond Sentry to all MCP

Agentjacking generalizes beyond Sentry's MCP integration to any MCP server relaying attacker-shaped text, per a Cloud Security Alliance note dated June 12.

That means the vulnerability isn't confined to one vendor's setup. It covers error trackers, issue trackers, PR comment threads, and browser DOM content, any pipe that carries outside text into an agent's context. Tenet tested agents connected through these servers and found only 15% resisted a hijack attempt.

Every agent that survived did the same thing. It stopped and asked for confirmation before running an unfamiliar npx command sourced from a tool's output rather than the user. The other 85% treated that tool-sourced text as a trusted instruction and ran whatever resolution steps the injected content suggested.

CSA's guidance is blunt. Treat every MCP tool output as untrusted input, the same scrutiny you'd give an unsolicited message from a stranger. Never auto-execute resolution steps sourced from outside data, the note says.

This is an MCP architecture problem, not a Sentry bug, and the only defense that worked was making agents pause before they act. Teams letting agents auto-run whatever a connected tool tells them are betting against odds CSA put a number on: 85% failure.

CSA's move from a single Sentry bug to a systemic MCP warning is what's pushing this into wider security conversation now.