AI analysis
Sentry Seer, Sentry's AI-powered debugging/fix agent, suffers from a multi-stage trust-boundary violation in which unauthenticated, attacker-controlled telemetry (Sentry events) is treated as trusted input and ultimately becomes code executed by the agent in a privileged automation environment. An external attacker triggers the flaw by submitting fabricated error events to a victim's Sentry organization without needing access to the victim's account, source repository, or infrastructure; when Seer processes the crafted events, the embedded content is translated into executed automation. Successful exploitation gives the attacker code execution within Seer's privileged environment, with whatever access that automation context carries. Any Sentry customer organization that has Seer enabled and accepts externally submitted event data is affected. As of this writing the flaw has no CVSS score, is not in CISA KEV, has no known public proof-of-concept, and there are no confirmed reports of in-the-wild exploitation (CERT/CC advisory VU#212479).
What to do: Track CERT/CC VU#212479 and Sentry's advisories for the patched release and apply it promptly, since Seer is a SaaS feature and remediation may arrive server-side or as a configuration change. Until patched, consider disabling Seer or excluding projects that receive unauthenticated SDK events (e.g., public-facing web/mobile apps) from automated analysis, and lock down event ingestion (DSN handling, allowlisted origins). Review Seer automation logs and any agent-executed actions for unexpected code execution or anomalous event sources.
Affected
| Sentry Seer (AI debugging/automation agent, Sentry SaaS) | — |
Estimated exposure
large≈tens of thousands of organizations (Sentry publicly reports 100,000+ customer organizations/~4M developers; Seer is an opt-in AI feature, so affected… — Estimate derived from Sentry's publicly stated customer base of 100,000+ organizations, discounted for the fact that Seer is an opt-in agent feature whose adoption numbers are not public.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.