Agentjacking: A Fake Sentry Error Became a 'Fix' That Claude Code and Cursor Ran

A public Sentry DSN let anyone plant an error whose fake 'Resolution' told Claude Code, Cursor and Codex to run npx. Every hop was authorized. What stops it.