Agentjacking exposes the security stack's authorized-action blind spot
Tenet Security's June agentjacking disclosure describes a proof-of-concept attack that hijacked Claude Code through a public Sentry credential, then used the developer's own privileges to expose AWS access keys and private repository URLs, while EDR, WAF, IAM, and the firewall registered nothing. The reason the stack missed it is the problem the disclosure actually surfaces: every step in the chain was authorized. The attacker sent a valid Sentry API call using a public DSN, the MCP server returned the injected event as legitimate output, and the agent executed the embedded instruction under the developer's identity. No signature fired because no rule was violated.
Security tooling is built to detect unauthorized activity, and the agentjacking chain runs entirely inside the authorized channel. Tenet tested over 100 targets in controlled conditions and reported an 85% success rate. Sentry, the disclosing company, described the flaw as "technically not defensible." Within days, the Cloud Security Alliance classified agentjacking as a systemic MCP vulnerability class, not an isolated bug.
The exposure scale follows from the design of MCP-connected telemetry, not from poor configuration. Tenet identified 2,388 organizations with publicly exposed Sentry credentials that could be used to inject malicious events at scale; the research is proof-of-concept, not confirmed exploitation. Sentry's DSN architecture is intentionally public for frontend error reporting, so revoking the credential is not the mitigation. The mitigation is restricting what the agent can do with the data those credentials return, which is a runtime control problem, not a configuration fix. Datadog, PagerDuty, Jira, and other trusted MCP data sources share the same exposure when the agent consuming their output has shell access and trusts the input.
The runtime distinction the stack cannot make is the central operational gap. SOC teams have never needed to distinguish between a developer running an npm install and an agent running that command in response to a malicious error event. That distinction did not exist until AI coding agents became production tools, and the telemetry pipelines most enterprises run do not produce it now. The stack that cannot make it is the stack agentjacking bypasses, and most stacks cannot make it.
The survey data from the first half of 2026 puts the agent footprint next to the control gap. Gravitee's State of AI Agent Security 2026, surveying over 900 executives and practitioners, found 14.4% of agents went live with full security approval, and 88% reported confirmed or suspected incidents. HiddenLayer's 2026 AI Threat Landscape Report, based on 250 IT and security leaders, found 33% reported agents had already exceeded intended scope, and 31% could not confirm whether they had experienced an AI breach. The Okta/Apprize360 survey of 292 executives and 492 knowledge workers found only 34% of organizations apply the same security controls to AI agents as to humans, 52% of employees use unapproved AI tools, and 58% of executives reported an AI-related incident or close call in the prior year. The same surveys show the disconnect between executive confidence and worker reality: 65% of executives say agent policies are clear, while 43% of workers agree.
CrowdStrike's Elia Zaitsev described the runtime problem directly in an interview cited in the source: "Securing agents looks very similar to securing highly privileged users. They have identities, access to underlying systems, they reason, they take action." He added that the safety net question, what happens when all controls fail, is what the industry has stopped asking. CrowdStrike's data, as reported in the source, places more than 1,800 agentic applications and approximately 160 million instances under monitoring. On June 15, the company shipped Continuous Identity for AI Agents at Identiverse, replacing static policies with continuous per-action authorization. The control class that announcement reflects, continuous action-level authorization with verifiable agent identity, has become a procurement criterion independent of vendor.
The procurement framing is where the governance and budget gap turns into a deployment decision. IEEE Senior Member Kayne McGladrey, in an interview cited in the source, framed the structural problem: the CISO does not have the budget, the staff, or the ownership of the business systems where agents run. When agent governance spans six departmental budgets, no single executive can confirm whether agents receive the same access reviews as humans. Qualtrics CSO Assaf Keren put it more bluntly: "The real risk starts not by the implementation of AI systems. It is the fact that baseline architecture is not well established. When we put an AI system on top of something not architected well, we are accelerating the fractures." Keren called runtime behavior analytics "an unsolved problem right now."
The deployment decision that follows from the disclosure is narrow. The agentjacking chain is not a novel attack on a new perimeter; it is a worked example of the gap between the speed of agent deployment and the maturity of the control plane around it. EU AI Act high-risk compliance obligations take effect August 2, 2026, which puts a deadline on the same observability gap the disclosure demonstrates. Organizations whose telemetry cannot distinguish agent-initiated from human-initiated actions will have difficulty meeting disclosure timelines regardless of which agent they run.
The dependency that decides whether any of this is fixable is the runtime action attribution problem. Without it, every other control is a static policy that an authorized agent can step around. The source does not present a method for closing that gap, and CrowdStrike's June 15 product announcement is one entry into a category the source frames as newly active, not yet settled.