A public Sentry DSN, an issue anyone can open, a pull request with a .mcp.json. Three recent findings show coding agents taking attacker instructions from their own tool output and handing over secrets. Here is the pattern, and what each runtime layer sees.
