WTF is Agentjacking?
Hijacking a coding agent by planting instructions in data it already trusts, such as error logs it reads over MCP.
Also called: agent hijacking
TL;DR
Your agent trusts the tools you connected. An attacker finds a way to write into one of those data sources (an error-tracking service with an open ingestion endpoint, say), disguises instructions as a system diagnostic, and waits. When you ask the agent to "look into that error", it reads the payload and runs it as if it were its own idea.
How it works
Documented against Sentry: attackers find a publicly exposed DSN, POST a crafted error event whose fields mimic Sentry's own diagnostic templates, and wait for a developer to ask their agent to investigate via the Sentry MCP server. In testing the payload executed on 85% of agents tried, and thousands of organisations had injectable DSNs. It is indirect prompt injection through a trusted tool channel. Defences: treat MCP data sources as untrusted, require approval before command execution, sandbox the agent, use short-lived credentials, and audit connected servers.
Origin
- Coined / introduced by
- Tenet Threat Labs
- When
- 12 Jun 2026
- Story
- Named in research published as a Cloud Security Alliance research note.