🔥 Top Story
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
On June 17, the Threat Labs team at Tenet Security — an AI-agent security startup newly out of stealth — disclosed an attack it calls "agentjacking" that turns AI coding agents into remote code-execution engines. The trick abuses a common workflow: asking an agent to fix unresolved errors in Sentry, the error-monitoring service, through the Model Context Protocol (MCP). Because a Sentry DSN is a write-only credential that is public by design (Sentry documents it as safe to embed in frontend JavaScript), anyone who finds one via a site's JS, a Censys query, or a GitHub search can post a crafted "error" that the agent later reads as an instruction and runs on the developer's own machine, with no malware exchanged and no password stolen. Tenet reports that Claude Code, Cursor, and Codex all acted on the injected errors, logging more than 100 confirmed executions across separate organizations — including a developer machine inside a $250 billion Fortune 100 technology company, plus agents in sandboxed CI pipelines, inside WSL on managed Windows, and behind corporate VPNs on both macOS and Windows. One captured Claude Code environment exposed a live AWS secret access key and identifiers for other connected agents, enabling lateral movement well beyond a single host. The root cause is that the agent cannot distinguish third-party data from a trusted instruction. Because Tenet sells the agent-runtime defense it concludes is necessary, its figures are best read as controlled test results rather than independent measurements.
💡 Why it matters: Treat every MCP tool result as untrusted input: if an agent can auto-act on third-party data like Sentry errors, that data path is a remote-code-execution channel, so gate tool output with human approval, least-privilege credentials, and sandboxed agent runtimes.
🔗 Read more · The New Stack
DevOps & Infrastructure
Your agent wants to search like a 2010 quant
The New Stack
This opinion piece argues that retrieval quality is now the main determinant of whether AI agents succeed, and that the tooling must evolve to match. It sketches three stages: the 2024 "vector database" era of chunking text and doing nearest-neighbor similarity search — simple but weak, because chunks lacked context and pure vector scoring missed relevant results. A second stage then married decades of classical information retrieval — hybrid search, BM25, machine-learned ranking — with vectors, pushing many use cases from demo to production quality. The author marks an emerging third stage signaled by Perplexity's "search as code" announcement. The central point is that consumer search engines were built on the assumption that human users are "lazy and clueless," so they treat query text as a vague hint and offer little precise control — visible in how Google drifted away from exact-word matching. Agents, by contrast, are neither lazy nor clueless, so there is no reason to cap them at a casual user's blunt interface; given expressive primitives they could run proximity searches (names appearing near each other in a legal case), pure semantic searches that prioritize high-quality sources, or year-range-and-group-by-month filters to build a timeline. Agents typically chain many such queries — overview, drill-down, hypothesis, verification — searching like an expert who cares about results, "like a quant doing financial analysis."
💡 If you build agent tooling, stop exposing only a consumer-grade "one fuzzy query box" search API; give agents structured, composable retrieval primitives — filters, proximity, ranking, faceting — so they can chain expert-level queries instead of being capped at a casual human's interface.
“An agent is an LLM and a harness”: What Nvidia really thinks about OpenClaw
The New Stack
The New Stack interviewed Nader Khalil, Nvidia's Director of Developer Technologies, to gauge how the company — and CEO Jensen Huang — relate to OpenClaw, an agent project Huang has publicly praised and backed despite its reputation as the "bad boy" of the agent world. Khalil, who co-founded Brev.dev (a startup that helped others access Nvidia AI chipsets) before Nvidia acquired it about two years ago, frames the discussion around a working definition: "an agent is an LLM and a harness." In his view an agent is fundamentally a loop plus an LLM, where each iteration should use the model's output — including reasoning about which new tools to call — to move measurably closer to the goal rather than repeating the same step. He credits ChatGPT with innovating "outside of the model," layering system prompts on top of user prompts, multimodal input, and persistent memory that made the assistant genuinely useful (his example: it remembers that he likes to barbecue and knows his smoker). Per the article's subtitle, the throughline is Nvidia backing OpenClaw, building reusable "agent blueprints," and betting that every enterprise will soon ship its own agents. The takeaway is that the differentiating engineering work in agents increasingly lives in the harness and surrounding scaffolding, not in the base model alone.
💡 Khalil's "an agent is an LLM and a harness" is a useful engineering frame: most reliability, cost, and differentiation come from the loop, tools, system prompt, memory, and file context you build around the model — so invest there (and in reusable blueprints) rather than treating the base model as the whole product.
This digest was collected from RSS feeds and summarized by AI (Claude). See the original links for full details.