Friendly Fire

You add Sentry to track errors. An attacker injects a fake error event through Sentry's public ingestion endpoint — no authentication required. Your AI coding agent sees the "error," reads the injected remediation steps, and executes a malicious package with your credentials. AWS keys, npm tokens, Docker credentials — gone.

Tenet Security tested this against Claude Code, Cursor, and Codex. Success rate: 85%. At least 2,388 organizations had injectable endpoints. They named it agentjacking. Sentry's response when asked to fix it at the platform level:

"Technically not defensible." The monitoring tool cannot distinguish malicious payloads from legitimate error messages containing code snippets and remediation notes — accepting that data is what it does.

The tool built to help you find bugs is the tool used to inject them. Not because Sentry is broken. Because Sentry works exactly as designed.

The Pattern

Over the past six months, the same structural dynamic has appeared across every layer of AI agent security: the mechanism built to protect creates an attack surface defined by its implementation. Not by failing. By functioning.

Defense	How It Works	Attack It Creates	Evidence
Per-prompt safety	Evaluates each prompt in isolation	Decompose attacks across prompts	53-86% ASR
Skill scanners	Match bytes in the file	Obfuscate: bytecode, whitespace, Unicode	8/8 bypassed
Error monitoring	Accepts and displays error data	Inject malicious remediation steps	85% success
Command validator	23 checks strip dangerous patterns	Reverse-engineer checks, find the gap	CVSS 9.1
Persistent memory	Stores context across sessions	Poison once, corrupt all future sessions	95%+ success
Code comprehension	Reads and understands code	Can't separate code from instructions	No patch exists

Six defenses. Six attack surfaces. Each row follows the same logic: the implementation detail that makes the defense work is the implementation detail the attacker exploits.

MOSAIC-Bench demonstrates this at the safety-alignment layer. Researchers decomposed 199 malicious objectives into routine engineering tickets. Nine production agents from six companies completed 53-86% of the attack chains. The same agents, prompted directly, succeeded 0-20.4% of the time. Per-prompt safety evaluates each prompt in isolation. The isolation is the vulnerability.

At Black Hat 2026, researchers reverse-engineered Claude Code's 23-check command validator, found it strips single-quoted text before validation, and placed a payload in git push --receive-pack — a flag Git executes directly. After the initial patch, two more bypasses followed. The validator designed to prevent execution was the constraint map the attacker used to find every gap.

The Deepest Instance

The AI Now Institute calls it "Friendly Fire." Prompt injections embedded in normal repository files — no hooks, no plugins, no MCP servers, no config files — steer AI security review agents into executing attacker code. Tested on Sonnet 4.6, Sonnet 5, Opus 4.8, GPT-5.5.

Their conclusion:

"A model update cannot fix it."

The other five rows in that table are implementation problems — bugs that can be patched, gaps that can be narrowed, scanners that can be improved. This row is architectural. The model's capability — reading and understanding code — is the vulnerability. It cannot reliably separate code it's analyzing from instructions it should follow. The capability and the attack surface are the same operation.

The Mirror

A July 2026 systematization-of-knowledge paper surveyed 39 execution-security defense papers for AI coding agents. They span 17 categories: sandbox isolation, capability control, policy enforcement, TOCTOU, MCP threats, identity delegation, execution provenance, network egress, static analysis.

The finding: papers across these categories "are published independently and rarely cite one another." Each addresses one layer. None studies how the layers interact.

The fragmentation of the defense research mirrors the fragmentation of the attack surfaces. Attackers compose across layers — decomposing a malicious objective into tickets that pass per-prompt review, embedding payloads that pass file-level scanning, injecting data through monitoring tools that trust their own inputs. The defenders study each layer in isolation.

The Numbers

The Gravitee State of AI Agent Security 2026 report surveyed 900+ executives and practitioners. The organizational picture matches the technical one:

Only 47.1% of an organization's agents are actively monitored. The enterprise agent estate doubled in four months. Security coverage barely moved.

Adoption outpaced control. But the table above suggests something worse: the controls themselves, when they arrive, will create the next generation of attack surfaces. The aiAuthZ paper moves authorization off-host entirely — an acknowledgment that on-agent safety is compromised. It's the right instinct. But an off-host gateway is a new layer. And every layer creates a new surface.

The pattern doesn't resolve. It recurs.