伪造一条 Sentry 错误事件，就能劫持编程智能体：受控测试成功率 85%One forged Sentry error event can hijack a coding agent: 85% success in controlled tests

With nothing more than a public Sentry DSN, an attacker can inject forged error events into a target project. When a developer asks a coding agent, via MCP, to look at unresolved errors, the agent treats the injected content as authoritative repair guidance and executes the attacker's commands with the developer's own permissions. Controlled tests succeeded 85% of the time, and the researchers found at least 2,388 organisations whose DSNs were injectable.

This is a research demonstration, with no confirmed in-the-wild exploitation. Sentry acknowledged the disclosure and said the platform cannot fully fix it, blocking only the specific payload strings. Compare INC-029: unauthenticated writes into a vector store there, into error events here; in both, whatever is written into context is trusted by default.

The failure is at the Knowledge layer's front door: external content arriving through retrieval and tool channels is treated as fact and as instruction by default. An error event is data, but to the agent it read as orders from above, with no boundary check in between.

Every channel that can write into an agent's context is attack surface. Trust levels must be explicit, and instructional content arriving through data channels is always downgraded.

Treat external content as untrusted: content entering context via retrieval, tools or third parties is untrusted; instructions inside it are never executed directly.

Confirm repair-class actions: fixes, deletions and deployments by an agent require human confirmation or source verification first.

Authenticate the write side too: error events, tickets and vector stores are written 'for the system'; they need the same authentication as the read side.