Back Oodaloop

New “Agentjacking” Attacks Could Hijack AI Coding Agents

Oodaloop • June 12, 2026

Researchers have revealed what they claim to be a “new class of attack” which tricks AI coding agents into executing arbitrary code on developer machines. Tenet Security, which specializes in the security of autonomous AI agent, said that “agentjacking” attacks exploit an architectural flaw in the Sentry app performance monitoring and error tracking tool, which is popular with developers. By using the techniques described in the Tenet report, an attacker would inject malicious commands into Sentry error events which are impossible to distinguish from the tool’s own remediation guidance. AI coding agents would then read and execute these instructions, in a way similar to an indirect prompt injection attack.

Full report : Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code.

Informing your decisions with actionable intelligence

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New GitHub Exploit Allows AI Coding Agents to Execute Malicious Payloads Researchers from Mozilla's 0DIN have demonstrated a new attack vector that allows AI coding agents, specifically Anthropic's Claude Code, to execute malicious payloads from seemingly benign GitHub repositories. The attack exploits the agent's automated error recovery process, where it runs initialization commands without human oversight. This method involves three steps: a Python package requiring initialization, a command that runs a script, and a DNS TXT record controlled by the attacker that retrieves and executes a payload. Notably, no malicious code exists in the cloned repository, making detection by security scanners and human reviewers nearly impossible. The attack grants the attacker a shell with the developer's privileges, allowing access to sensitive data such as environment variables and API keys. Although currently a proof-of-concept, the method poses a significant risk to developers using automated coding tools. The researchers recommend treating automated initialization steps as untrusted execution and implementing explicit human approval gates. No active exploitation has been reported yet. 67 sources 62

Extracted Entities

New “Agentjacking” Attacks Could Hijack AI Coding Agents

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)