Send one fake error report and hijack the AI coding agent: Sentry Seer gets a CVE

Ok-Pepper-2354 · reddit · 2026-09-18

The Agyn team disclosed CVE-2026-90999: sending Sentry Seer a crash report for a bug that never happened is enough to get attacker-controlled code executed inside a coding agent holding repo access and credentials.

The chain: an error report doesn't mean the error happened — the sender controls every field, and errors arrive via a public DSN shipped in the browser bundle, so anyone can send one. Attacker sends a fabricated exception to the public DSN → Seer marks it eligible for automated remediation → Seer writes a root-cause analysis from attacker-controlled fields (exception message, stack trace, source context, breadcrumbs) → that analysis lands in the coding agent's prompt as a trusted, high-privilege instruction → the agent fetches and runs attacker-controlled code in an environment with your source and repo credentials.

Applies when Seer hands issues to a coding agent, automated remediation (no human review) is on, and the project reports via a public DSN. Severity: fully autonomous with no victim interaction; one payload works against any matching project; the only "credential" is the already-public DSN.

Mitigations until patched: pause automated integration; prevent agents from installing packages autonomously. The root pattern is an agent with real capabilities acting on untrusted input. Reported to the vendor and held until CERT's disclosure date (VU#212479).

Original post →

More from coding & agent

coding & agent channel →