CVE-2026-90999 (PhantomFix): Fabricated Sentry Events Steer Seer Autofix Into Coding-Agent RCE (CVSS 9.8)

CERT/CC vulnerability note VU#212479 (published 16 September 2026; researchers Nikita Benkovich and Vitalii Valkov of agyn, who also wrote it up as PhantomFix on 14 September) tracks CVE-2026-90999 in Sentry Seer's autonomous remediation path. When Seer is configured to hand issues to a coding agent automatically, an unauthenticated attacker who can POST to a project's public DSN (the normal browser telemetry endpoint) submits a fabricated exception event. Seer builds a root-cause analysis from attacker-controlled fields (exception messages, stack traces, source context, breadcrumbs), embeds that analysis in the coding agent's initial prompt, and the agent treats it as a legitimate description of the victim codebase — then downloads and executes an attacker-controlled package inside the agent environment before any human reviews a pull request, with access to connected source repositories. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This is distinct from the June 2026 AgentJacking write-up already in this feed (ti-035), which described intercepting/proxying agent Sentry MCP traffic via an exposed DSN; PhantomFix is vendor-hosted Seer autofix turning untrusted telemetry into agent tasking with no account on the victim org required. At advisory time no vendor-supplied customer patch was published (Sentry Seer is SaaS "Web site" per NVD); exploit specifics were held pending a fix.

You are affected if you run Sentry Seer autonomous remediation / coding-agent handoff (SaaS; NVD lists version as "Web site"). Exposure requires Seer auto-handoff plus a public DSN (typical for frontend projects). Not a defect in Claude Code, Cursor, or Codex themselves — those agents are the execution environment Seer can invoke..

If you use Sentry Seer with automatic coding-agent remediation on a project that has a public DSN, disable automated remediation / Seer handoff until Sentry confirms a fix — that is the CERT/CC primary mitigation. Restrict the coding agent's ability to install new packages without approval, and keep repository credentials scoped as narrowly as possible. Rotate any project DSN that has lived in client-side bundles or public repos (raises the bar for targeting a specific project; does not remove the class). Treat untrusted telemetry (exception messages, breadcrumbs, source context) as untrusted input to any agent prompt — never pass Seer analysis into an agent as if it were a trusted task description. Monitor CERT/CC VU#212479 and Sentry status for vendor remediation confirmation. Distinct from ti-035 AgentJacking: rotating the DSN alone does not close Seer autofix.