Tenet researchers showed at DEF CON 34 that poisoned content, such as a fake error entry or a crafted User-Agent header, can steer coding agents like Cursor and Claude Code into harmful changes once they read it through MCP integrations with Cloudflare, Datadog and Sentry.
It’s a tidy demonstration that anything an agent reads is an instruction waiting to happen. As vendor research it deserves a pinch of salt on the scale of the problem.
Sources: SC Media
