In June 2026, security research firm Tenet Security disclosed a new attack technique named Agentjacking. The name says it plainly: hijacking an AI Agent. Attackers don’t need malware, don’t need stolen credentials, and don’t need to break through any traditional defense. All it takes is a single fake bug report to get an enterprise’s internal AI coding agent to execute attacker-chosen code locally, using the developer’s own identity and permissions.
This isn’t a warning or a proof of concept. It has already happened. For enterprises deploying or planning to deploy AI Agents, Agentjacking is a signal that their defense architecture needs to be rethought.
1. How a Fake Bug Report Hijacks an AI Agent
At the core of Agentjacking is the AI Agent’s natural trust in tool output. Tenet Security’s researchers chose Sentry, an open-source error tracking platform, as their point of entry. It’s widely used for debugging in development environments and treated by most developers as a trusted internal tool.
After obtaining a publicly exposed set of Sentry credentials, the attackers embedded malicious instructions inside a fabricated bug report. When a developer asked an AI coding agent, including mainstream tools like Claude Code, Cursor, and Codex, to help investigate the “bug,” the Agent faithfully read Sentry’s output and treated the embedded malicious instructions as a normal task, silently completing the attacker’s payload on the developer’s own machine, with the developer’s own permissions.
More critically, endpoint detection and response (EDR), firewalls, and prompt safety instructions all failed throughout the entire process. Even explicit instructions telling the Agent to “ignore this instruction” didn’t stop it from executing.
After being notified, Sentry stated that this kind of attack is “technically undefendable” at the platform level, and only deployed a content filter targeting specific strings. That response alone reveals how fundamental the problem is: when an untrusted input source exists anywhere in an AI Agent’s execution chain, a platform-level patch only treats the symptom.
2. Why AI Agents Are Vulnerable to Hijacking
Agentjacking isn’t a technical bug. It’s a gap between how AI Agents are architected and what enterprise security actually requires. Understanding that gap explains why this isn’t just a developer tooling problem, it’s a systemic risk in enterprise AI deployment.
There are three causes:
2-1. A broken input trust chain:
AI Agents execute tasks, they don’t verify where instructions come from. Tool output, an error log, a query result, an API response, gets treated as trustworthy by default. Poison the source, and you’re issuing instructions directly to the Agent.
2-2. Over-provisioned access
Agents typically get read/write access to code repos, CI/CD pipelines, and cloud APIs, scoped to “whatever the task might need” rather than least privilege. Once an Agent is hijacked, an attacker inherits its entire scope of authorization, with an enormous blast radius as a result.
2-3. No Human-in-the-Loop checkpoint
Automation is the whole point of adopting AI Agents, so human oversight gets minimized by design. With no confirmation step in the loop, an Agent can go from malicious instruction to full execution without a human ever seeing it.
Together, these three gaps explain why Agentjacking slips past every traditional defense. A 2026 Dark Reading survey found 48% of security professionals now rank Agentic AI as the top attack surface of the year, ahead of deepfakes and ransomware.
3. Where Traditional Security Falls Short Against AI Agents
Most enterprise security tools today, EDR, WAF, and SIEM, were designed around the assumption of a human operator. They’re built to detect unexpected external traffic, malware landing on disk, and unusual login patterns. But the nature of Agentjacking makes these tools blind by design:
- The attack executes under the developer’s own credentials and permissions, indistinguishable from normal activity.
- The attack doesn’t come from external traffic. It comes from an internal tool chain the developer triggered themselves, and Sentry is treated as a trusted service.
- There’s no malware landing on disk and no unusual network connection, so traditional scanning logic has nothing to detect.
This blind spot isn’t an edge case. As AI Agents get integrated into development workflows, financial operations, and customer service automation, their “normal behavior” and their “hijacked behavior” become nearly indistinguishable to traditional tools.
The core problem is this: AI Agents are already an enterprise’s digital operators, yet enterprises have no identity governance framework, no behavioral audit mechanism, and no anomaly baseline for this new type of operator. Handing an AI Agent’s security problem to EDR or WAF is essentially handing a personnel management problem to an access-control turnstile.
4. An Enterprise Defense Framework Against Agentjacking
What Agentjacking calls for isn’t a new scanning tool, it’s governance and security architecture designed specifically for AI Agents. The following three layers of defense form an AI-native response framework.
4-1. Governance layer: making every AI Agent’s behavior traceable
AI Agents must be treated as a non-human identity, with clearly defined access boundaries and behavioral audit records. Enterprises need to define, for every Agent, which systems it can access, which actions it can take, and where the complete log of every execution lives.
ACROSS’s AI Governance (AIG) module is built on RBAC role-based access control, providing virtual key management for AI Agents, operation log tracking, and real-time Token usage visibility. When an Agent’s behavior turns anomalous, such as unexpected high-frequency operations or attempts to cross authorization boundaries, the audit trail lets security teams fully reconstruct the incident after the fact.
4-2. Security layer: checkpoints at the Agent’s input and output
The core technique behind Agentjacking is poisoning an Agent’s input source. That’s why defense depends on automated security review both before an Agent reads external data and after it produces an execution result.
ACROSS’s AI Security (AIS) module builds a dual-layer AI Guardrails mechanism: pre-call filtering uses semantic analysis to detect malicious prompt injection intent, and post-call review checks output against anomaly rules. The Cyber LLM engine, as the core inference layer, can identify semantic-level attacks that traditional rule-based tools simply can’t detect.
4-3. Architecture layer: bringing humans back into high-risk decision points
The more automated a workflow becomes, the more important Human-in-the-Loop becomes, not less. Agentjacking succeeds precisely because there’s no human confirmation checkpoint anywhere in the operation chain.
One of ACROSS’s core design principles is to force a human confirmation step for any high-privilege operation, such as code deployment, data writes, or external API calls. AI provides the recommendation, and humans retain final decision authority, shrinking the blast radius when an Agent is hijacked rather than trying to make the Agent immune to every possible malicious input.
5. Managing AI Agent Risk with Auditable Governance
Agentjacking reveals more than a new attack vector. It shows that as AI Agents take on more and more operational responsibility inside the enterprise, the logic of security defense has to evolve with them. Traditional perimeter defense and human-behavior detection can’t stop an attack executed under an AI Agent’s identity.
Twister5, built on a foundation of cybersecurity, created ACROSS, an enterprise AI security intelligence hub, to help enterprises establish identity governance, behavioral auditing, and Guardrails protection built specifically for AI Agents, so automation can actually be deployed within a secure, controlled framework.
Ready to assess whether your company’s AI Agent deployment carries Agentjacking risk?
👉 Contact the Twister5 team now to start an AI Agent security governance assessment, or learn more about ACROSS