The most dangerous attack on crypto infrastructure this year doesn't target a smart contract, a bridge, or an exchange hot wallet. It targets the developer's machine, through the AI agent they trust to write code.
At DEF CON 34, Tenet Security demonstrated an attack chain they call "Agentjacking." They claim an 85% success rate against 100+ organizations. The vector: public Sentry DSNs combined with MCP-enabled AI coding agents. The prize: AWS keys, GitHub OAuth tokens, npm registry credentials, Docker tokens — the exact keys that unlock crypto deployments, private key access, and exchange API control.
Volume is the only truth the market respects. Here, the volume is 2,388 exposed Sentry DSNs across organizations, 71 in the Tranco top 1M websites, and roughly 27% of Fortune 1000 companies reachable through Cloudflare's MCP integration. These aren't theoretical numbers. They are the attack surface.
Context: The Architecture of Trust
Sentry is the dominant error-monitoring platform. It collects crash reports via a DSN (Data Source Name) — a public identifier that allows anyone to POST error events to a project. No authentication required. That's by design. It's meant to be lightweight.
In 2025, Anthropic's Model Context Protocol (MCP) became the standard for connecting AI coding agents like Cursor and Claude Code to external tools. Developers connect their agent to Sentry via MCP, so the agent can read error logs and suggest fixes. It's a natural workflow: debug faster, ship faster.
But the intersection of two innocent design decisions creates a vulnerability. Sentry's unauthenticated ingestion endpoint accepts any POST with a valid DSN. MCP lets the agent read Sentry issues as context. The agent treats that context as trusted data — including any markdown-formatted "fixes" embedded by an attacker.
Core: The Six-Step Attack Chain
The attack is a variant of indirect prompt injection. It doesn't bypass model safeguards. It exploits the default trust between agent and tool outputs.
- Discover public DSNs. Attackers scan public repositories, pastebins, or leaked configs for Sentry DSNs. 2,388 organizations are exposed.
- POST malicious error events. Using the public DSN, the attacker sends a crafted error payload to Sentry. The payload contains markdown with injection instructions disguised as a fix suggestion.
- Developer triggers agent. The developer sees a Sentry alert and asks their AI agent: "Check the latest Sentry issues and fix this."
- Agent reads the malicious issue. The MCP connection fetches the issue. The agent's reasoning model treats the markdown as legitimate instructions.
- Agent executes the malicious fix. The injected prompt tells the agent to run
npm installa malicious package, or execute a shell command.
- Credential theft. The malicious package exfiltrates environment variables, SSH keys, and API tokens from the developer machine.
The current AI agent architecture cannot distinguish data from instructions. This is the root cause. No amount of prompt engineering fixes it. The agent sees a string in a database; it does not know if that string was written by an attacker.
Sentry deployed a content filter to block specific payload strings. That's a static IoC-level blacklist. Easily bypassed with encoding or randomization. Tenet released agent-jackstop, a set of endpoint hardening configurations: network egress whitelisting, command execution approval, subprocess credential isolation, and treating all tool outputs as untrusted. These are mitigation steps, not a cure. The architecture flaw remains.
For crypto, this is terrifying. Crypto developers routinely manage private keys, deploy contracts, and access exchange APIs from their workstations. A compromised AI agent can steal the keys to Layer 2 sequencer wallets, exchange cold storage access, or smart contract admin keys. When the faucet runs dry, the dryers crack. The faucet of proper security hasn't run yet — but when it does, the cracks will be in the AI agents that are now standard in every developer toolchain.
Contrarian: The Blind Spot of On-Chain Focus
While the crypto industry obsesses over on-chain exploits, DeFi audits, and cross-chain bridge security, the attack surface shifts to the developer's chair. The largest crypto hacks in history — Ronin, FTX, Wormhole — all involved social engineering or credential theft. Agentjacking automates that theft at scale, targeting the one asset every developer trusts: their AI pair programmer.
The contrarian angle: the threat may be overhyped in controlled demonstrations, but the potential for real damage is underestimated. In a real deployment, a developer under pressure to fix a production bug is far more likely to approve the agent's suggested fix without scrutiny. The 85% success rate in a lab likely translates to higher in the field.
Crypto projects are rushing to adopt AI coding agents to accelerate development. They are also rushing to adopt MCP for tool integration. The market is chasing ghosts in the digital art auction house, while the real threat is quietly stealing developer credentials.
Takeaway: The Next Major Crypto Hack Will Come Through an AI Agent
This is not a drill. The crypto industry must add "Agent Security" as a new pillar in its risk management playbook. Implement network whitelisting, command approval, and credential isolation for all AI coding workflows today. MCP protocol needs a security extension that tags tool outputs with a trust level and allows the agent to distinguish between data and instructions.
The question is not if an agent-compromised attack will drain a crypto treasury. The question is when. Are you ready to trust your AI agent with your private keys?
