senn-techAgentjacking: When an Error Report Hijacks Your AI Agent
Coding agents have arrived in everyday work — and with them, a new attack class. Agentjacking exploits not a flaw in the model but the agent's trust in its tools. Anyone deploying agents productively needs to understand that a new attack surface emerges here — and that proven IT-security principles still apply unchanged. That is especially true for SMEs, where AI agents increasingly gain access to production-adjacent systems and a single faulty automation quickly has real consequences.
How the Attack Works
- Trust as the entry point: AI coding agents like Claude Code or Cursor routinely read tool output — for example error reports from an error-tracking service such as Sentry.
- Malicious command in the data stream: an attacker plants hidden instructions in exactly that output. The agent cannot cleanly separate data from command and executes it along the way.
- The result: the agent does things no one asked for — changing code, reading secrets, running commands. Classic prompt injection, just over a channel you used to trust.
The insidious part: these channels are classically considered harmless. A stack trace or a log file is perceived as pure information — not as a potential source of commands. Exactly that assumption is what the attack breaks. In practical terms: everything the agent reads as data — an API response, a web page, a file imported by the user — must be treated as potentially hostile.
What Actually Helps
- Least privilege: the agent runs with minimal rights, without broad access to secrets, production, or the open internet.
- Human in the loop: writing or executing actions are confirmed, not blindly automated.
- Sandbox & egress control: execution is contained and outbound connections are restricted — exfiltrated data does not get far.
- Distrust your sources: tool output is data, not instructions. Anchor that in your agent design and the attack class loses its footing.
These measures sound banal, because they are exactly what good IT security demands anyway. That is the point: against agentjacking, no new tool helps — only the consistent application of familiar principles.
Why now
The reason this attack class is becoming relevant now is simple: agents increasingly access external data sources — ticket systems, documentation, log archives. Each additional source is a potential injection channel. The more tools an agent drives, the larger the surface over which instructions can be smuggled in. That this is no longer theoretical is shown by the breach around OpenAI and Hugging Face's model-evaluation pipeline. For SMEs, where agents often work with access to production-adjacent systems, that carries particular weight. Add to this: anyone who deploys agents without clear guardrails because time is short opens exactly the flank the attack needs.
Our Take
Agentic coding is here to stay — and so is this attack class. The lesson is not "no agents," but the same one as always in security: make trust explicit, keep privileges small, secure the executing steps. Run agents that way and you get their strength without opening the flank.
Further Reading
What exactly is agentjacking?+
Agentjacking is a form of prompt injection via tool output. An attacker hides instructions in data the agent reads anyway — say an error report from Sentry or a log file. Because the agent cannot cleanly separate data from command, it executes the instruction along the way: changing code, reading secrets, or running commands.
Which guardrails protect against agentjacking?+
Least privilege: the agent runs with minimal rights and no broad access to secrets or production. Human in the loop: writing actions are confirmed. Sandbox and egress control contain execution and throttle outbound connections. Tool output is treated as data, not instructions — familiar security principles rather than new tools.
Do we have to give up AI agents as a result?+
No. The lesson is not to avoid agents, but as always in security: make trust explicit, keep privileges small, and secure executing steps. A clear policy governing which tools an agent may connect at all closes most of the attack surface up front. That way you get the agents' strength without opening the flank.