Sentry Seer AI agent flaw enables code execution

A prompt-injection flaw in Sentry's Seer AI debugging assistant lets attackers achieve code execution in connected coding agents via public telemetry endpoints.

CERT/CC has published an advisory (VU#212479, CVE-2026-90999) describing a vulnerability in Sentry's Seer feature, an automated debugging assistant that can hand off issues to an integrated coding agent for remediation. Because Sentry projects commonly expose a public DSN endpoint to accept telemetry from browsers, an attacker can submit crafted exception events containing malicious content in fields such as stack traces, exception messages, and breadcrumbs. When Seer is configured to automatically forward issues to a coding agent, this attacker-controlled content is embedded into the analysis prompt given to the agent, effectively becoming an untrusted instruction set that crosses multiple trust boundaries.

The coding agent, believing the fabricated root-cause analysis describes the victim's actual codebase, may then download and execute an attacker-controlled package as part of its investigation — achieving arbitrary code execution within the coding-agent environment before any human reviews the resulting pull request. This gives an attacker a foothold with access to connected source repositories, effectively turning an automated remediation pipeline into a supply-chain injection vector.

No vendor patch is currently available. CERT/CC recommends disabling automated remediation handoff from Seer to coding agents, restricting package installation capability within coding-agent environments, and applying defensive filtering of telemetry content prior to Seer analysis. There is no indication in the advisory of confirmed in-the-wild exploitation; this is disclosed as a discovered vulnerability by researchers Nikita Benkovich and Vitalii Valkov of agyn.

title: Sentry Seer Agent Downloading and Executing Packages
description: Detects coding agent or analysis subprocess downloading and executing
  packages (pip, npm, apt, curl + execute) in sequence. Matches the behaviour where
  a malicious telemetry payload triggers agent-driven package installation without
  human review.
tags:
- attack.execution
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_python_pip:
    CommandLine|contains:
    - pip install
    - python -m pip
    Image|endswith:
    - \python.exe
    - \pip.exe
  selection_npm:
    CommandLine|contains: npm install
    Image|endswith: \npm.cmd
  selection_apt:
    CommandLine|contains: apt-get install
    Image|endswith: \apt.exe
  selection_curl_execute:
    CommandLine|contains:
    - curl
    - wget
    Image|endswith:
    - \curl.exe
    - \wget.exe
  filter_known_paths:
    CommandLine|contains:
    - Program Files
    - AppData
  condition: (1 of selection_*) and not filter_known_paths
falsepositives:
- Legitimate CI/CD pipelines installing dependencies in automated build environments
- Software development tooling installing packages during normal workflow
level: medium
id: aca9951c-18f1-55ce-8a83-80afea954709
status: experimental
author: Vorant

title: Malicious Telemetry Payload Injection into Sentry DSN
description: Detects HTTP POST requests to Sentry DSN endpoints (public telemetry
  collectors) with suspiciously large or complex payloads in stack trace, exception
  message, or breadcrumb fields. Matches attacker-controlled crafted events designed
  to influence downstream code-analysis agents.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    DestinationHostname|contains: sentry.io
    Protocol: https
  http_method_post:
    Protocol|contains: POST
  payload_fields:
    HttpRequest|contains:
    - '"stackTrace"'
    - '"exception"'
    - '"breadcrumbs"'
    - '"message"'
  payload_size:
    HttpRequestBodySize|gt: 5000
  condition: selection and http_method_post and payload_fields and payload_size
falsepositives:
- Legitimate error reporting from JavaScript-heavy web applications with large stack
  traces
- Mobile application crash reporting with extended diagnostic data
level: low
id: eeb862bd-af17-5d94-8a83-ca604bfaf959
status: experimental
author: Vorant

title: Code Analysis Agent Executing Commands from Telemetry Payload
description: Detects command-line or subprocess execution initiated by an analysis/agent
  process that has parsed exception event data, where the command arguments contain
  patterns matching injected telemetry field content. Flags code-execution chains
  typical of Seer agent prompt-injection exploitation.
tags:
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_agent_parent:
    ParentImage|endswith:
    - \seer.exe
    - \agent.exe
    - \analyzer.py
    - \remediation.py
  selection_shell_exec:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \python.exe
    - \node.exe
    - \bash.exe
  selection_suspicious_args:
    CommandLine|contains:
    - stackTrace
    - exception
    - breadcrumb
    - root-cause
  filter_admin_remediation:
    User|contains: SYSTEM
  condition: selection_agent_parent and selection_shell_exec and selection_suspicious_args
    and not filter_admin_remediation
falsepositives:
- Legitimate debugging agents that log or echo telemetry fields for diagnostic output
- Analysis tools that tokenise or parse exception content as part of normal workflow
level: high
id: 20dd283c-7b32-5f8f-a264-725dea24508c
status: experimental
author: Vorant

Source reporting: https://kb.cert.org/vuls/id/212479