Tracing the hash that broke the ledger
2,388 public Sentry DSNs. 85% attack success rate. One HTTP POST per target. The numbers are clean, cold, and damning—but they don’t tell the full story. What Tenet Security demonstrated at DEF CON 34 isn’t just another prompt injection exploit. It’s a combinatorial failure of two individually rational design decisions: Sentry’s unauthenticated ingestion endpoint and the Model Context Protocol’s blind trust in tool output. The result is a credential theft chain that turns your AI coding assistant into a reverse proxy for your AWS keys, GitHub tokens, and npm registry secrets.
Auditing the invisible supply chain
Let me set the stage with the technical architecture. Sentry, the error monitoring platform, uses a Data Source Name (DSN) to authenticate incoming error reports. The DSN is a public key embedded in client-side code—it’s not secret, but it’s also not meant to be writable by arbitrary third parties. However, the ingestion endpoint accepts any POST request containing a valid DSN, because Sentry’s design assumes that error reports are benign data. Enter the Model Context Protocol (MCP), an open standard that allows AI agents like Claude Code and Cursor to query external tools. When a developer asks the agent to debug a Sentry issue, the MCP integration fetches the issue’s markdown content and feeds it directly into the agent’s reasoning context.
This is the invisible supply chain I’ve been auditing for years. In my 2017 ICO due diligence days, I saw the same pattern: two separate components that are secure in isolation, but when combined, create a gaping hole. The DSN is the public identifier, the MCP is the trust bridge, and the agent’s inability to distinguish between “data” and “instructions” is the exploit.
Sifting noise to find the alpha signal
The attack chain is elegant in its simplicity. Step one: an attacker scans public repositories for exposed Sentry DSNs—Tenet found 2,388 organizations with discoverable DSNs, including 71 in the Tranco top 1 million websites and roughly 27% of Fortune 1000 companies exposed through Cloudflare’s MCP integration. Step two: the attacker POSTs a malicious error event to Sentry’s ingestion endpoint, embedding a payload that appears as a markdown “fix suggestion.” Step three: the developer, using an AI coding agent, asks the agent to investigate the Sentry issue. The MCP integration fetches the issue, and the agent treats the markdown content as authoritative instructions. Step four: the agent executes the fake fix—typically an npm install command that pulls a malicious package from a typosquatted registry. Step five: the malicious package exfiltrates environment variables, SSH keys, and OAuth tokens.
This is not a theoretical vulnerability. Tenet’s controlled test across 100+ organizations achieved an 85% success rate. The metric is noisy—test conditions may overestimate real-world efficacy—but the technical closure is undeniable. The agent doesn’t need to be jailbroken; it simply trusts its tools. The data source doesn’t need to be compromised; it’s designed to accept arbitrary writes. The only missing piece is the human trigger: the developer must ask the agent about the Sentry issue. But in a high-velocity coding environment, that’s a routine query.
Building yield in a vacuum of trust
Now for the contrarian angle. The crypto community loves to blame “bad code” or “insufficient auditing,” but this attack is not a code bug—it’s an architecture flaw. MCP and Sentry both operate in a vacuum of trust: they assume that data from a trusted source (Sentry’s API) is safe to execute. This is the same fallacy that led to the 2022 Terra collapse, where the oracle’s price feed was treated as ground truth without verifying the integrity of the data source. Correlation is not causation, but the pattern is identical: a system that cannot distinguish between a signal and a command will eventually treat an attack as a signal.
Tenet’s proposed mitigation—agent-jackstop—is a drop-in configuration that enforces network egress whitelists, command execution approval, and subprocess credential isolation. It’s a band-aid, not a cure. The root cause is that MCP, as a protocol, has no mechanism for declaring the trustworthiness of a data source. It doesn’t require a “content type” header that distinguishes between data and instructions. It doesn’t enforce a hierarchy of commands from the user versus the tool. Until the protocol itself evolves, every MCP-connected agent is one malicious error report away from a credential dump.
The code didn’t run, the trust boundary did
Let me ground this in my own experience. In 2020, while building a DeFi yield optimizer, I wrote a Python script that monitored Uniswap liquidity pools. The script trusted the pool data directly from the blockchain—no middleware, no MCP, no API. That’s because the blockchain provides a trustless execution environment: the data is immutable, the state is verifiable, and the smart contract defines the rules. MCP, by contrast, introduces a trusted third party (Sentry) that can be arbitrarily manipulated. The irony is that the crypto industry spent years building trustless systems, only to see the same trust assumptions creep back in through the AI agent layer.
Now, the market implications. Sentry faces a choice: either invest in platform-level authentication (e.g., signed envelopes, DSN rotation, IP whitelisting) or watch enterprise customers migrate to self-hosted alternatives like OpenTelemetry with custom MCP gateways. Tenet is positioning agent-jackstop as a commercial product, likely with an enterprise tier for centralized policy management. The real winner, however, will be the MCP security gateway category—a middlebox that sanitizes tool outputs, enforces data provenance, and logs agent decisions. This is the same playbook that gave us Web Application Firewalls (WAFs) in the early 2000s.
Entropy in the order book
One final data point that the hype cycle misses. Tenet’s disclosure timeline is murky: they claim they notified Sentry on June 3, 2026, but DEF CON 34 is typically held in August 2025. Either the date is a typo, or the attack was developed over a year before public disclosure. That gap matters. It means the vulnerability was known to a small group for months, and the only reason it wasn’t weaponized is that no one had the incentive to do so—yet. As AI coding agents become mandatory in enterprise DevOps, the incentive to weaponize this attack will grow exponentially.
Surviving the liquidation cascade
The takeaway is not a prediction, but a signal. The next major event in this space will not be a new model release or a token launch. It will be a mass credential theft via a public Sentry DSN, executed by a script that scans GitHub and sends POST requests while you sleep. The question is not whether this will happen, but whether the market will price in the risk before or after the cascade.
I’ll be watching the on-chain data for an unusual spike in GitHub token revocations—that’s the real alpha signal. Everything else is just noise.
