Fake Bug Report Hijacks AI Coding Agents at Scale

A research report by Tenet Security has revealed a critical vulnerability in AI coding agents, demonstrating how a simple, fabricated error report submitted to a bug tracking service (Sentry) can be used to hijack these agents and execute arbitrary code on a developer's machine. This ‘agentjacking’ technique exploits the agents’ inability to distinguish between data and instructions, allowing attackers to steal credentials, compromise development environments, and potentially access sensitive data. The findings highlight a previously unrecognized attack surface and underscore the need for organizations to rethink their approach to securing AI-powered tools.