Fake Bug Report Shows AI Coding Agents Can Be Turned Into an Enterprise Attack Path

**Executive summary:** Researchers demonstrated a new attack technique called "agentjacking" that hides malicious instructions in fake bug reports or poisoned Sentry error logs (publicly exposed DSNs), causing AI coding assistants to retrieve and execute attacker-controlled commands; more than 2,300 organizations were identified with exposed DSNs, and a successful attack could lead to theft of cloud credentials, tokens, SSH keys, or access to code and CI/CD systems.