Public Sentry DSNs Give AI Coding Agents Remote Code Execution

Tenet Security showed at DEF CON 34 that a public Sentry DSN is enough to get code running on a developer's machine. Controlled testing across more than 100 organizations found the chain works 85% of the time, and a follow-up scan turned up 2,388 organizations with publicly discoverable DSNs, 71 of them inside the Tranco top-1M.

The trick sits in Sentry's ingest endpoint, which accepts crafted error events with no authentication. Tenet packed the event's message field with markdown written to look like remediation steps, and when a developer asks Claude Code or Cursor to debug the resulting issue, the agent pulls that fake guidance through MCP and executes it with local privileges.

Sentry shipped a content filter on payload strings but stopped there, telling Tenet a full platform fix is "technically not defensible," per Forkast's report. No CVE was assigned, so this attack chain won't turn up in a dependency scanner or a security advisory feed. Tenet published its own fix instead: agent-jackstop, a deny-by-default egress allowlist for Cursor and Claude Code, posted to GitHub.

Sentry's non-answer is correct, and that's the uncomfortable part. A bug tracker can't tell a real stack trace from one written to look like operator instructions, and that trust boundary lives inside the agent, not the data source. The same gap shows up in related coverage of MCP servers: an audit found 91.8% of production servers ship with no OAuth at all.

If Claude Code or Cursor is wired into a Sentry project, the DSN sitting in the client-side bundle is worth checking. An egress allowlist belongs in front of the agent before it debugs anything else.