The AI-agent threat everyone warned about is now a measured campaign. Researchers this month detailed Agentjacking — an attack that hijacks AI coding agents through Model Context Protocol (MCP) injection — and the numbers are hard to ignore: 2,388 organizations exposed through injectable Sentry DSNs, and an 85% exploitation success rate across Claude Code, Cursor and the OpenAI Codex CLI.
How the attack works
Agentjacking is textbook indirect prompt injection: the malicious instructions don’t come from the user, they sit in content the agent retrieves on its own. In one documented case, a single Google Docs file was enough to make an AI IDE agent fetch instructions from a hostile MCP server and execute a Python payload that harvested secrets — with no user interaction at all.
Once the agent is talking to a poisoned MCP server, the attacker inherits everything the agent can do: read files, run shell commands, reach internal services, and exfiltrate credentials. The agent looks like it’s doing its job the whole time.
Why it hits so many teams
- MCP servers install in one line and nobody reviews them — the agent reads their tool descriptions as instructions.
- Indirect injection is invisible to the user: the payload is in a document, a web page or a tool’s output, not in the prompt.
- Coding agents are the most privileged process on the machine, sitting on top of source, secrets and often production access.
How to defend
Static review before install won’t catch a server that behaves badly at runtime, so the control has to sit in the call path. Concretely: pin and hold MCP servers on change, scope every tool to least privilege, and gate the action the injection asks for — because you can’t scan injection out of natural language, but you can refuse the exfiltration it requests. That’s exactly what our runtime firewall airlock_ai is built to do.
Before that, find out whether your agents are actually exploitable. We run AI agent penetration testing, MCP server security testing and prompt injection testing against real agent deployments — the same techniques Agentjacking uses, run under controlled conditions.
Deploying AI coding agents? Get an attacker’s view first with AI agent penetration testing, or put airlock_ai in the call path. Get a fixed-price quote.