Two stories dropped yesterday that cut straight to the heart of where AI coding agents stand right now.

First the security one. A new attack called agentjacking turns any publicly exposed Sentry DSN into a backdoor. Attackers inject arbitrary instructions into your error queue. When your coding agent (Claude Code, Cursor, or OpenAI Codex) pulls those errors through the Sentry MCP integration, it treats the injected text as legitimate context and executes under your privileges. Tenet Security measured an 85% success rate across tested setups.

This isn’t theoretical. The integration is popular because it gives agents real runtime context. That same convenience is now a reliable attack vector. If your Sentry DSN is in any public repo, issue tracker, or log that an agent can reach, the agent is now potentially compromised.

The second story came from Mark Zuckerberg in an internal town hall. He acknowledged that the company’s bets on AI agents “haven’t come to fruition yet” and that the trajectory over the last four months “hasn’t really accelerated in the way that we expected.” This lines up with what a lot of teams are quietly seeing: agents are great at benchmarks and greenfield tasks, but the messy reality of production codebases, private data access, and reliable multi-step execution is still the bottleneck.

Claude Sonnet 5 shipping as the new default for every Claude user is the bright spot from the week, but it also increases the attack surface. More agents running more tasks means more places where a single poisoned error log can cause real damage.

The practical takeaway for anyone running agents today is simple: treat every DSN and every external data source your agent touches as potentially hostile. Rotate keys, scope permissions aggressively, and consider running agents with the narrowest possible Sentry integration or none at all until the ecosystem hardens.

The gap between “agents that can code” and “agents you can trust in production” just got a little more visible.