A manipulated error message, it turns out, can be more dangerous than anyone expected.
When researchers at Tenet Security figured out how to commandeer AI coding agents through doctored Sentry error reports—claiming an 85% exploitation success rate across more than 100 organizations—they weren't conducting a thought experiment. They'd uncovered something messier: enterprises racing to deploy autonomous AI agents had created a vulnerability that conventional security infrastructure wasn't designed to catch.
The discovery helped set the stage for what came next. On June 17, 2026, the cybersecurity startup—now headquartered in the U.S., though it originated from Tel Aviv-Yafo, Israel—stepped out of stealth mode with $6 million in seed funding, led by The Westly Group and joined by MizMaa Ventures. Its platform, now available to customers, tackles what founders Barak Sternberg and Nevo Poran have dubbed "Agentjacking"—attacks that exploit the trust relationships between AI agents and their data sources, slipping past traditional defenses almost by design.
It's a problem that, perhaps more than the founders initially expected, has already manifested in the wild.
Elite Intelligence Backgrounds, Offensive Security Roots
Sternberg and Poran share a familiar origin story in Israeli cybersecurity circles: both served in Unit 8200, the intelligence corps' elite cyber unit. Before Tenet, they'd built Cisco's AI Defense research team. And before that? Sternberg—a DEF CON and Black Hat speaker who once earned an Israel Defense Prize—ran an offensive security firm called Wild Pointer alongside Poran.
By the time they turned their attention to AI agents, they were seeing what looked to them like a looming crisis. "AI agents may be the biggest productivity unlock," Sternberg said in the company's launch statement, "but most security tools were never designed to understand [agent behavior]."
The gap, according to emerging data, isn't small. Okta, which rolled out its own AI agent security framework on April 30, 2026, found that 88% of organizations have reported AI agent security incidents. Tenet's research goes further: the company estimates that enterprises typically have about five times more AI agents deployed than they realize. Coding assistants, customer-facing chatbots, automation workflows—many running with surprisingly little oversight.
Runtime Defense Over Guardrails
Tenet's pitch is built on a different technical approach than the prompt filters and LLM guardrails that dominated early AI security conversations. The company deploys what it describes as a "lightweight sensor" that ties together operating system behavior, network activity, API calls, and the reasoning chains of large language models themselves. No proxies required. No code rewrites.
The system reconstructs complete agent sessions—every tool invocation, every data access point, every decision node—into what Tenet calls a "session graph," essentially a forensic playback of what an agent actually did (and why).
The more novel piece, though, is something called "Agent-Side Simulation," a patent-pending technique that runs parallel simulations of agent actions up to three steps ahead. It sandboxes potential tool calls before they execute in production environments. Think of it as a runtime kill switch that anticipates where an agent is heading and blocks dangerous paths before they materialize.
"The only place left to catch these threats is at runtime," Poran said, "in the moment an agent decides to act."
Tenet claims sub-30-millisecond performance overhead and the ability to complete full risk assessments in under three hours. The platform integrates with existing endpoint detection and response (EDR) systems, secure service edge (SSE) tools, and cloud infrastructure—no SDK implementation necessary.
The Agentjacking Disclosure
The company's June 9, 2026 disclosure of so-called "Agentjacking" attacks—Tenet Security's findings on which added urgency to their platform's pitch—put the issue front and center. Tenet's research team discovered 2,388 organizations with exposed Sentry Data Source Names (DSNs) that could be exploited to inject malicious instructions into popular AI coding agents—Claude Code, Cursor, GitHub Copilot.
The attack works like this: when agents automatically pull error data from Sentry's Model Context Protocol server, attackers can embed commands that agents dutifully execute as what appear to be legitimate troubleshooting steps. It's elegant. It's also alarmingly effective.
Tenet reported the vulnerability to Sentry on June 3, 2026. According to Tenet's account—and there's always more than one side to these disclosure stories—Sentry acknowledged the risk but declined to patch at the protocol level, calling it "technically not defensible." The company instead added a content filter targeting specific payload strings. The disclosure drew attention from outlets like The Hacker News, and the Cloud Security Alliance published research notes on the attack vector between June 12 and 14.
Whether the industry will settle on a more robust fix remains an open question.
Early Wins, Crowded Competition
Tenet says early deployments have already intercepted real attacks, though the details are naturally murky. A U.S. legal institution—annual recurring revenue over $1 billion, 24 million users—reportedly blocked more than 10 attacks during early use, including what Tenet characterized as a critical cross-site scripting vulnerability. One Fortune 1000 enterprise caught a runaway agent burning tens of thousands of dollars in token costs over a single weekend during a proof-of-value test.
Stories like these are useful, if inherently unverifiable.
The company is also entering a market that's gotten crowded in a hurry. Okta, Menlo Security, SentinelOne, Salt Security—all announced agent security capabilities between March and April of this year. Cisco signaled its intent to acquire Astrix Security on May 4, 2026, specifically to address AI agent and non-human identity risks. Noma Security and a handful of others have planted flags in agent monitoring and governance.
It's early enough that no one's certain which approach will dominate.
The Path Forward
Tenet plans to use the $6 million to expand its Threat Labs team, build out North American sales and marketing operations, and extend framework coverage. The platform already claims alignment with OWASP's 2026 Top 10 for Agentic Applications, NIST's AI Risk Management Framework, and EU AI Act requirements—the kind of box-checking that enterprise buyers increasingly expect.
The company's advisor roster leans practical: CISOs from Robinhood, GoPuff, and AdaptHealth, plus Ken Huang, who leads OWASP's AI Verification Standard project. That's the kind of bench you assemble when you're trying to define a category, not just grab market share within an existing one.
Whether Tenet's runtime simulation approach becomes the industry standard or one methodology among many is still anyone's guess. But as enterprises accelerate AI agent deployments—often faster than they fully grasp the attack surface—the market for tools that can observe what agents are actually doing, not just what they're supposed to do, looks less hypothetical with each passing quarter.
And that error message exploit? A reminder that in the rush to automate, the most dangerous vulnerabilities are often the ones no one thought to look for in the first place.
