Your WAF Blocked Us, That Was The Exploit

The speakers argue that AI agents cannot separate data from instructions, so any untrusted text that reaches an agent's context, such as logs or error reports, can act as a command. They start with Sentry. Public DSNs embedded in front-end JavaScript let anyone submit an error event, and the message field accepts markdown that the Sentry MCP passes to the agent unchanged. A crafted error can therefore persuade a Claude Code session to run an attacker-chosen package. They extend the idea to Seer, Sentry's hosted agent. Injected breadcrumbs make Seer recommend installing a package, and Cursor trusts that recommendation more than raw input, so one agent compromises another.

The Cloudflare chain begins with a request that a managed WAF rule blocks. The payload sits in the user-agent header, which the MCP returns, while the body that triggered the block stays hidden. An agent reviewing blocked requests then treats the user-agent text as troubleshooting facts and used Cloudflare's own MCP tools to add a DNS record. No code ran on the victim machine. The speakers also describe a Claude sandbox escape: the egress proxy accepted a JWT that was not bound to a container, so an attacker-minted token allowed traffic to arbitrary domains. Anthropic has since fixed it. For persistence, they describe poisoning memory files, skills and MCP configuration, which existing EDR and WAF tooling would not flag.

Their takeaways are to limit which MCPs and external domains agents can reach, to treat all externally sourced data as contaminated, to enforce egress controls at runtime, to require human approval for high-risk actions, and to audit agent memory and config files for tampering.