Agentjacking: a public Sentry DSN plus an MCP integration equals RCE, 85% of the time.

Tenet Security showed at DEF CON 34 that Sentry's unauthenticated ingest endpoint lets anyone with a public DSN POST a crafted error event whose message fields contain markdown reading like remediation guidance. Ask Claude Code or Cursor to debug Sentry issues, and the agent pulls the injected event through MCP and executes it with local privileges. 85% success across 100+ organizations in controlled testing; 2,388 orgs found with publicly discoverable DSNs, 71 in the Tranco top-1M. Sentry added a payload-string filter but declined platform-level remediation as "technically not defensible." No CVE assigned. Mitigation repo is tenet-security/agent-jackstop, shipping deny-by-default egress allowlists.