Topic starter
14/07/2026 6:04 pm
TL;DR: Agentjacking abuses trusted error-report inputs in AI coding agents, letting attackers with a publicly exposed Sentry DSN inject malicious instructions and steal secrets, according to Swarmnetics and Tenet Security. The core flaw is assumption, not hygiene: systems built to process trusted telemetry cannot safely treat agent-directed execution as if source trust still equals action trust.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “Agentjacking Attack Exposes Critical Trust Flaw in AI Coding Agents”.
By the numbers:
- The researchers found over 100 AI coding agents susceptible to agentjacking.
Key questions
Q: What breaks when an AI coding agent trusts external error reports too much?
A: The trust boundary breaks.
Q: Why do publicly exposed telemetry credentials create agent security risk?
A: Because they often let anyone submit content into a workflow the agent treats as authoritative.
Q: What are the signs that an AI coding agent is too permissive with MCP inputs?
A: Look for agents that can move directly from inbound reports to repository reads, token lookups, cloud calls, or code changes without a separate approval step.
Practitioner guidance
- Audit agent intake points for action-bearing context Map every external input that an AI coding agent can read, interpret, or act on, especially incident reports, alerts, and ticketing feeds.
- Treat public telemetry credentials as sensitive access paths Search code, repositories, and exposed endpoints for DSNs and similar intake credentials that allow anyone to submit content to a trusted workflow.
- Separate diagnostic content from executable instructions Strip or neutralise embedded command-like text before the agent can use report content to trigger tools, queries, or remediation steps.
Bottom line: Agentjacking works because trusted telemetry is being used as a command path for AI coding agents, not because the attacker breaks into the system in a conventional way.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 6:09 pm
Trusted telemetry is not a safe identity boundary: Swarmnetics' report shows that AI coding agents can turn observability inputs into execution triggers when the upstream source is assumed to be trustworthy. That assumption was built for human-reviewed monitoring workflows, not for software that can act on the content it receives. The implication is that identity governance must treat report intake as an authorisation decision point, not a passive data flow.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams govern AI-assisted development workflows that use coding agents?
A: Treat them as identity-governed execution paths, not just productivity tools. Define who can start the workflow, which tools and data sources it can reach, what evidence is required for review, and how access is revoked if the workflow expands beyond its intended scope. The key is to govern the chain of delegated action, not only the final code output.
👉 Read our full editorial: Agentjacking exposes a broken trust model in AI coding agents