A Public Sentry Key Is Enough to Hijack Claude Code, Cursor, and Codex: The Risk of AgentJacking

The New Attack Vector: AgentJacking

On June 17, the Threat Labs team at Tenet Security, a security startup for AI agents just out of stealth, documented a critical vulnerability affecting AI-based coding assistants such as Claude Code, Cursor, and Codex. The attack, dubbed AgentJacking, exploits public Sentry keys exposed in public repositories or poorly protected configurations. With just one Sentry key, an attacker can inject malicious commands into the agent's workflow, compromising the integrity of the generated code and potentially exfiltrating sensitive data.

Technical Impact on SysAdmins and DevOps

For system administrators and DevOps teams, this vulnerability represents a direct threat to the software supply chain. AI agents, when integrated with development environments, can be manipulated to introduce malicious code, backdoors, or even modify infrastructure configurations. The risk is magnified when these agents have access to repositories, API keys, or production environments. The exposure of a Sentry key, which is normally considered harmless, becomes a high-impact attack vector.

Business Implications

From a business perspective, AgentJacking can lead to significant financial losses, intellectual property theft, and reputational damage. Organizations adopting AI assistants to accelerate development must reassess their security policies. Trust in AI tools is compromised if strict controls over credentials and permissions are not implemented. This incident underscores the need for a security-by-design approach, where even seemingly innocuous keys are treated as critical assets.

Mitigation Measures

To protect against AgentJacking, it is recommended to: rotate Sentry keys periodically, scan repositories for exposed credentials, limit AI agent permissions to the minimum necessary, and monitor for anomalous behavior in coding assistants. Additionally, integrating security solutions like those offered by Tenet Security can help detect and prevent such attacks. Collaboration between security and development teams is crucial to maintain the integrity of the software lifecycle.

For a deeper dive into infrastructure protection, we recommend reading our article on Hardening and Maintenance of Linux Servers and the guide on Advanced Solutions in Microsoft Azure. Likewise, the Linux Foundation's ANS project offers an interesting perspective on AI agent identity, which you can check out in DNS as a Foundation for AI Agent Identity.

Source: The New Stack. ForgeNEX Analysis.