Sentry Seer trust-boundary violation lets unauthenticated telemetry become code executed by a privileged coding agent

CERT/CC published VU#212479 on Sept 16, 2026 describing a multi-stage trust-boundary violation in Sentry Seer: attacker-controlled telemetry submitted through a public, unauthenticated endpoint is executed as code by an agent operating in a privileged automation environment with access to source repositories.

This is a novel agent-execution attack class — it does not require compromising the victim's application at all, only the ability to submit a crafted event to a public ingestion endpoint, which is then automatically escalated into privileged remote code execution by the AI coding agent designed to auto-remediate bugs. It demonstrates that any pipeline auto-feeding external content to a privileged agent is a critical attack surface.

An external attacker submits a fabricated Sentry event via the public telemetry-ingestion endpoint without needing access to the victim's application; the fabricated event content flows, unsanitized, into the privileged automation environment where a coding agent executes it as instructions, resulting in arbitrary code execution and access to connected source repositories.

Sentry Seer (auto-remediation coding-agent integration)

Apply the fix referenced in CERT/CC VU#212479; disable automatic hand-off of unvalidated telemetry to coding agents until patched; treat all telemetry/error content as untrusted input requiring sanitization before reaching agent context.