The approval gate that always said yes: OpenSRE's headless shell bypass
---
title: "The approval gate that always said yes: OpenSRE's headless shell bypass"
tags: security, ai, llm, appsec
---
The approval gate that always said yes: OpenSRE's headless shell bypass
A vector breakdown of CVE-2026-109444 / GHSA-fqh3-76w5-5vvf (OpenSRE through 0.1.2026.10.19)
I write a lot about approval gates that check the wrong thing. This one doesn't check anything. In OpenSRE's headless mode the function that decides whether the agent may run a shell command ignores its inputs and returns True. Put that next to an agent whose job is reading alerts and Slack messages, and anyone who can get text in front of it can run commands on the host.
What the advisory actually says
From GHSA-fqh3-76w5-5vvf and the VulnCheck advisory, published October 20, 2026 at 03:32 UTC:
- Product: OpenSRE (Tracer-Cloud), an AI site-reliability agent. Affected: through 0.1.2026.10.19. No fixed release is listed.
- Weakness: CWE-862, Missing Authorization. Severity: High, CVSS 3.1 score 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It's network-reachable, needs no privileges, and needs one "user interaction": the agent has to triage the attacker's content.
- The bug: "an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True."
- Impact: "Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials."
- Credit: VulnCheck credits Noy Pearl, Michael Sromin and Ophir Dror.
The advisory links two lines in the source, and both are worth reading.
The vector: untrusted text in, shell commands out
1. An attacker gets text in front of the agent. The advisory names two routes: an alert the agent is asked to triage, or a Slack message.
2. The text contains instructions. The model can't reliably tell "data I'm analyzing" from "instructions I should follow," so it decides to call shell_run.
3. Before running a command, OpenSRE asks the active presenter whether execution is allowed. In the interactive terminal that's where a human confirms.
4. In headless surfaces (the Slack gateway, scheduled runs, embedded use) the presenter is HeadlessSubprocessPresenter. Its execution_allowed() takes the policy result and an action summary, discards both, and returns True.
5. The command runs on the host with whatever the process can reach, and the advisory says that includes LLM, Slack and cloud credentials.
No authentication step is skipped. The attacker never logs in. They just write something the agent will read.
Why this class of bug exists: three root causes
The advisory covers what's wrong, not the fix. Here's the class split into causes you can look for in any agent framework.
1. Approval treated as a UI feature instead of a security control
Mechanism. The decision to run a risky action is handed to the presentation layer, the part that draws prompts and buttons. That works when there's a terminal and a human. When the same agent runs headless, the presentation layer has nobody to ask, so someone writes a stub. A stub for a print method is harmless. A stub for the permission check is the vulnerability.
Evidence. The module's own docstring describes it as the presenter "for non-TTY agent surfaces (gateway, scheduled, embedded)." Its execution_allowed() ignores the ExecutionPolicyResult it's handed and returns True. The project's commit history shows the presenter was registered in an August 2026 change (#4845) so that "the default agent can execute" shell_run. That was a reasonable fix for "the agent can't run commands," made through a component that never enforced policy.
What fixes it. The allow/deny decision belongs in the execution path, not the presenter. The presenter can show a prompt, but the policy result itself should decide whether the command runs. If a surface can't ask a human, the policy has to answer, and the safe default answer for an unreviewed shell command is no.
2. "No human available" fails open
Mechanism. Approval prompts are annoying in chat. They stall, time out and clutter threads. The tempting fix is to drop them on that surface. Unless something else takes over the gate, that turns "needs approval" into "approved."
Evidence. The second line the advisory links is in the Slack dispatcher, where a comment says: "No approval prompts in Slack for now. Button waits stalled the turn until the timeout and posted extra replies in the thread." The turn is then set up with tool_hooks=None. That's an honest usability tradeoff. It also means that in Slack the shell tool runs on the model's say-so.
What fixes it. When an approval can't be collected, fail closed: refuse the action, or queue it for a human somewhere else and tell the user it's waiting. Faster is fine for read-only tools. Anything that writes, executes or touches credentials should be denied by default on surfaces with no approver.
3. The agent reads attacker text with operator authority
Mechanism. An SRE agent exists to read noisy, untrusted input such as alerts, logs and messages from anyone in a channel. If the same model turn that reads that input can also call a shell, the attacker's text has the same pull on the model as the operator's instructions. And if the shell runs in a process holding long-lived credentials, every successful injection becomes a credential leak.
Evidence. The advisory's attack path is exactly this: instructions "inject[ed] into alerts or Slack messages triaged by the agent," leading to command execution and exfiltration of "LLM, Slack and cloud credentials." The CVSS vector requires no privileges, only that the agent processes the content.
What fixes it. Treat everything the agent triages as untrusted data. Split reading from acting: a turn that ingests external content shouldn't hold the shell tool, or its tool calls should need approval that untrusted content can't grant. Run the executor without the agent's own API keys in its environment, and give it scoped, short-lived cloud credentials.
How this connects to the other approval-gate bugs
Usually the gate exists but checks too little, such as the verb without the object or the parent agent without its sub-agents. Here the gate exists in the interactive path and is a no-op in the headless one. It's the same lesson again: an approval control is only as strong as its weakest execution surface. If you can't name who approves a shell command in Slack, nobody does.
Defensive takeaways you can check this week
- Find out if you run it. If you have OpenSRE at or below 0.1.2026.10.19, assume headless surfaces (Slack gateway, scheduled runs, embedded use) execute shell_run with no confirmation. No fixed release is listed yet, so watch the advisory for one.
- Stop exposing the headless path to untrusted input. Until there's a fix, don't connect the Slack gateway to channels where people outside your on-call team can post, and don't point scheduled triage at alert sources that carry text an outsider controls.
- Take the credentials away from the shell. Run the agent in a container or VM whose environment doesn't hold your LLM keys, your Slack bot token or broad cloud credentials. Use scoped, short-lived roles.
- Rotate if you were exposed. If an affected version triaged outside content in headless mode, rotate the LLM, Slack and cloud credentials it could read, and review its command history and outbound network logs.
- Audit your own agents for the same pattern. Search for approval or *_allowed methods that return a constant, and for surfaces that pass None for hooks or approvers. For each one, ask what happens when nobody is there to click.
- Test the headless path. Add a test that puts a prompt-injection string in an alert or chat message and asserts the shell tool is refused, not just that a prompt was shown.
Sources
- GitHub advisory GHSA-fqh3-76w5-5vvf
- NVD entry for CVE-2026-109444
- VulnCheck advisory
- Lasso Security vulnerability database entry
- subprocess_presenter.py at the advisory's referenced commit
- Slack dispatcher at the advisory's referenced commit
---
If you're building agent backends and want a checklist for this kind of trust boundary, the Trust Boundary pack covers it.
This article was drafted with AI assistance and edited by a human. All facts come from the advisory, its CVE record and the source lines it references.
10 projetos open source do GitHub para turbinar o seu fluxo de trabalho | Vol. 8
10 projetos open source do GitHub para turbinar o seu fluxo de trabalho, em contagem regressiva e com 10 segundos para cada um. Tem agentes de código rodando em paralelo, revisão automática entre agentes, câmeras que viram sensores do Home Assistant, vídeo com IA no seu computador e mais.
📺 Oitavo volume da série Open source do GitHub. Último commit conferido em 14/10/2026. Segue o canal e ativa as notificações para não perder a próxima.
Qual desses você vai testar primeiro? Conta nos comentários!
⏱️ CAPÍTULOS E LINKS
0:00 Abertura
0:10 #10 diri: rode dezenas de agentes de código em paralelo, cada um no seu worktree
cristicretu/diri
0:20 #9 DashLit: página inicial self-hosted para links e serviços, com status ao vivo
codewec/dashlit
0:30 #8 zeroshot: quem escreve o código não aprova: outros agentes revisam antes do PR
the-open-engine/zeroshot
0:40 #7 OpenBot: colegas de IA self-hosted, cada um com computador e navegador
CopilotKit/openbot
0:50 #6 OpenSRE: monte agentes de IA de SRE que investigam falhas em produção
Tracer-Cloud/opensre
1:00 #5 CLI-Anything: qualquer programa vira uma linha de comando para agentes (52 mil estrelas)
HKUDS/CLI-Anything
1:10 #4 VisionState: IA local transforma câmeras em sensores do Home Assistant
oleost/VisionState
1:20 #3 Rooms: cada projeto vira uma sala no Mac, com as janelas no lugar
saragordic/rooms
1:30 #2 FreeVideo: vídeos com IA no seu computador, com modelos abertos
FlashML-org/FreeVideo
1:40 Oferecimento Hallen Tech
1:54 #1 Claude Squad: vários agentes de código num terminal só
smtg-ai/claude-squad
2:04 Encerramento
🧡 Oferecimento: Hallen Tech, liderança de tecnologia sob demanda, software, cloud e segurança para a sua empresa.
Site: hallentech.com
E-mail: contato@hallentech.com
Instagram: instagram.com
LinkedIn da Hallen Tech: linkedin.com
LinkedIn do Eddwan: linkedin.com
Se curtiu, deixa o like, segue o canal e ativa as notificações para a próxima lista.
#opensource #github #inteligenciaartificial
61 likes · 1,867 views
OpenSRE: Build Your Own AI SRE Agents (12k stars)
What it does
All text below is quoted directly from the project README.
>The open-source framework for AI SRE agents, and the training and evaluation environment they need to improve. Connect the 60+ tools you already run, define your own workflows, and answer production questions on your own infrastructure.
Why OpenSRE?
When something breaks in production, the evidence is scattered across logs, metrics, traces, runbooks, and Slack threads. OpenSRE is an open-source framework for AI SRE agents that resolve production incidents, built to run on your own infrastructure.
OpenSRE is building that missing layer:
>an open reinforcement learning environment for agentic infrastructure incident response, with end-to-end tests for realistic production failures
We do that by:
- building easy-to-deploy, customizable AI SRE agents for production operations and incident response
- running real-world end-to-end tests across cloud-backed scenarios
- keeping semantic test-catalog naming so e2e vs unit and local vs cloud boundaries stay obvious
>Public Alpha: Core workflows are usable for early exploration, though not yet fully stable. The project is in active development, and APIs and integrations may evolve.
Repository
Tracer-Cloud/opensre
Repository stats
|Metric|Value|
|:-|:-|
|Stars|11,674|
|Forks|1,709|
|Last release|v0.1.2026.10.9 (2026-10-09)|
|Languages|Python 99.6%|
|Contributors|366|
|AI contributor accounts (Claude / Codex / Cursor / Copilot)|Claude: 215, Cursor: 290, Copilot: 27|
|AI co-authored commits|Claude: 217, Codex: 1, Cursor: 299, Copilot: 35|
Main contributor
|Field|Value|
|:-|:-|
|Name|Vincent Hus|
|GitHub|@davincios|
|Commits to this repo|1,050 (top contributor)|
|Bio|CEO @ OpenSRE 🏃|
|Company / Location|opensre.com, London|
|Website|discord.gg|
|X / Twitter|@vincent_hus|
|Followers|307|
|Public repos|47|
|On GitHub since|2017-10-29|
17 points
Mentions
🔗 Repositorio oficial y arquitectura: Tracer-Cloud/opensre 📌 Guarda este post para explorar agentes autónomos aplicados a SRE.
线上出了故障，真能让 AI 来帮着查？ OpenSRE 就是干这个的——它是个搭建 AI SRE 智能体的框架，能把运维工具接进来、把排障流程定义清楚，还附带训练和评测环境。 眼下它还在 Public Alpha 阶段，拿来试试水、探探路正合适。 🔗Tracer-Cloud/opensre t.co
Projetos open source do GitHub: #10 a #6 | Vol. 8 #shorts Os projetos #10 a #6 do Top 10 open source do GitHub, Vol. 8, 10 segundos para cada um. #10 diri: cristicretu/diri #9 DashLit: codewec/dashlit #8 zeroshot: the-open-engine/zeroshot #7 OpenBot: CopilotKit/openbot #6 OpenSRE: Tracer-Cloud/opensre Vídeo completo com os 10 no canal Hallen Tech. Oferecimento: Hallen Tech, hallentech.com #shorts #opensource #github
The approval gate that always said yes: OpenSRE's headless shell bypass --- title: "The approval gate that always said yes: OpenSRE's headless shell bypass" tags: security, ai, llm, appsec --- The approval gate that always said yes: OpenSRE's headless shell bypass A vector breakdown of CVE-2026-109444 / GHSA-fqh3-76w5-5vvf (OpenSRE through 0.1.2026.10.19) I write a lot about approval gates that check the wrong thing. This one doesn't check anything. In OpenSRE's headless mode the function that decides whether the agent may run a shell command ignores its inputs and returns True. Put that next to an agent whose job is reading alerts and Slack messages, and anyone who can get text in front of it can run commands on the host. What the advisory actually says From GHSA-fqh3-76w5-5vvf and the VulnCheck advisory, published October 20, 2026 at 03:32 UTC: - Product: OpenSRE (Tracer-Cloud), an AI site-reliability agent. Affected: through 0.1.2026.10.19. No fixed release is listed. - Weakness: CWE-862, Missing Authorization. Severity: High, CVSS 3.1 score 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It's network-reachable, needs no privileges, and needs one "user interaction": the agent has to triage the attacker's content. - The bug: "an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True." - Impact: "Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials." - Credit: VulnCheck credits Noy Pearl, Michael Sromin and Ophir Dror. The advisory links two lines in the source, and both are worth reading. The vector: untrusted text in, shell commands out 1. An attacker gets text in front of the agent. The advisory names two routes: an alert the agent is asked to triage, or a Slack message. 2. The text contains instructions. The model can't reliably tell "data I'm analyzing" from "instructions I should follow," so it decides to call shell_run. 3. Before running a command, OpenSRE asks the active presenter whether execution is allowed. In the interactive terminal that's where a human confirms. 4. In headless surfaces (the Slack gateway, scheduled runs, embedded use) the presenter is HeadlessSubprocessPresenter. Its execution_allowed() takes the policy result and an action summary, discards both, and returns True. 5. The command runs on the host with whatever the process can reach, and the advisory says that includes LLM, Slack and cloud credentials. No authentication step is skipped. The attacker never logs in. They just write something the agent will read. Why this class of bug exists: three root causes The advisory covers what's wrong, not the fix. Here's the class split into causes you can look for in any agent framework. 1. Approval treated as a UI feature instead of a security control Mechanism. The decision to run a risky action is handed to the presentation layer, the part that draws prompts and buttons. That works when there's a terminal and a human. When the same agent runs headless, the presentation layer has nobody to ask, so someone writes a stub. A stub for a print method is harmless. A stub for the permission check is the vulnerability. Evidence. The module's own docstring describes it as the presenter "for non-TTY agent surfaces (gateway, scheduled, embedded)." Its execution_allowed() ignores the ExecutionPolicyResult it's handed and returns True. The project's commit history shows the presenter was registered in an August 2026 change (#4845) so that "the default agent can execute" shell_run. That was a reasonable fix for "the agent can't run commands," made through a component that never enforced policy. What fixes it. The allow/deny decision belongs in the execution path, not the presenter. The presenter can show a prompt, but the policy result itself should decide whether the command runs. If a surface can't ask a human, the policy has to answer, and the safe default answer for an unreviewed shell command is no. 2. "No human available" fails open Mechanism. Approval prompts are annoying in chat. They stall, time out and clutter threads. The tempting fix is to drop them on that surface. Unless something else takes over the gate, that turns "needs approval" into "approved." Evidence. The second line the advisory links is in the Slack dispatcher, where a comment says: "No approval prompts in Slack for now. Button waits stalled the turn until the timeout and posted extra replies in the thread." The turn is then set up with tool_hooks=None. That's an honest usability tradeoff. It also means that in Slack the shell tool runs on the model's say-so. What fixes it. When an approval can't be collected, fail closed: refuse the action, or queue it for a human somewhere else and tell the user it's waiting. Faster is fine for read-only tools. Anything that writes, executes or touches credentials should be denied by default on surfaces with no approver. 3. The agent reads attacker text with operator authority Mechanism. An SRE agent exists to read noisy, untrusted input such as alerts, logs and messages from anyone in a channel. If the same model turn that reads that input can also call a shell, the attacker's text has the same pull on the model as the operator's instructions. And if the shell runs in a process holding long-lived credentials, every successful injection becomes a credential leak. Evidence. The advisory's attack path is exactly this: instructions "inject[ed] into alerts or Slack messages triaged by the agent," leading to command execution and exfiltration of "LLM, Slack and cloud credentials." The CVSS vector requires no privileges, only that the agent processes the content. What fixes it. Treat everything the agent triages as untrusted data. Split reading from acting: a turn that ingests external content shouldn't hold the shell tool, or its tool calls should need approval that untrusted content can't grant. Run the executor without the agent's own API keys in its environment, and give it scoped, short-lived cloud credentials. How this connects to the other approval-gate bugs Usually the gate exists but checks too little, such as the verb without the object or the parent agent without its sub-agents. Here the gate exists in the interactive path and is a no-op in the headless one. It's the same lesson again: an approval control is only as strong as its weakest execution surface. If you can't name who approves a shell command in Slack, nobody does. Defensive takeaways you can check this week - Find out if you run it. If you have OpenSRE at or below 0.1.2026.10.19, assume headless surfaces (Slack gateway, scheduled runs, embedded use) execute shell_run with no confirmation. No fixed release is listed yet, so watch the advisory for one. - Stop exposing the headless path to untrusted input. Until there's a fix, don't connect the Slack gateway to channels where people outside your on-call team can post, and don't point scheduled triage at alert sources that carry text an outsider controls. - Take the credentials away from the shell. Run the agent in a container or VM whose environment doesn't hold your LLM keys, your Slack bot token or broad cloud credentials. Use scoped, short-lived roles. - Rotate if you were exposed. If an affected version triaged outside content in headless mode, rotate the LLM, Slack and cloud credentials it could read, and review its command history and outbound network logs. - Audit your own agents for the same pattern. Search for approval or *_allowed methods that return a constant, and for surfaces that pass None for hooks or approvers. For each one, ask what happens when nobody is there to click. - Test the headless path. Add a test that puts a prompt-injection string in an alert or chat message and asserts the shell tool is refused, not just that a prompt was shown. Sources - GitHub advisory GHSA-fqh3-76w5-5vvf - NVD entry for CVE-2026-109444 - VulnCheck advisory - Lasso Security vulnerability database entry - subprocess_presenter.py at the advisory's referenced commit - Slack dispatcher at the advisory's referenced commit --- If you're building agent backends and want a checklist for this kind of trust boundary, the Trust Boundary pack covers it. This article was drafted with AI assistance and edited by a human. All facts come from the advisory, its CVE record and the source lines it references.
这周 GitHub 上涨星最猛的 10 个 AI 开源项目 每个一分钟讲清楚：它是干什么的、为什么火、装上之后你的 AI 能多做什么。每个项目都配了一台等距机械动画，用机器的动作把原理演出来。 ⏱ 时间戳 00:00 开场：本周 GitHub 涨星 TOP 10 00:35 01 REA：让 AI 逆向任何 App，一直拆到二进制 01:41 02 skills：让 AI 先问清楚、再写测试的编程技能包 02:42 03 diagram-design：一句话让 AI 画出专业图解 03:39 04 OpenMontage：把 AI 编程助手变成视频工作室 04:38 05 claude-mem：给 AI 加上跨对话的长期记忆 05:29 06 free-claude-code：用免费额度跑 Claude Code 这类编程工具 06:29 07 knowledge-work-plugins：Anthropic 官方出的 11 个岗位插件 07:29 08 AirLLM：4GB 显卡跑 70B 大模型 08:33 09 text-to-cad：一句话生成能加工的 3D 零件 09:28 10 OpenSRE：让 AI 帮你排查线上故障 10:29 结尾 🔗 项目链接 01 REA：morluto/rea 02 skills：mattpocock/skills 03 diagram-design：cathrynlavery/diagram-design 04 OpenMontage：calesthio/OpenMontage 05 claude-mem：thedotmack/claude-mem 06 free-claude-code：Alishahryar1/free-claude-code 07 knowledge-work-plugins：anthropics/knowledge-work-plugins 08 AirLLM：lyogavin/airllm 09 text-to-cad：earthtojake/text-to-cad 10 OpenSRE：Tracer-Cloud/opensre 📌 说明 星数截至 2026 年 10 月 16 日，本周增量来自 GitHub Trending。 free-claude-code 不是 Anthropic 官方项目；AirLLM 的 125B 模型 6GB 训练指的是 LoRA 微调。 这 10 个里，你最想先装哪一个？评论区聊聊。 #GitHub #AI #开源项目 #ClaudeCode #AI编程
OpenSRE（1.2 万 star）：SRE agent 开源工具箱，「自己搭值班」。接 60+ 工具（Grafana、K8s 等），告警抓日志指标链路、脱敏推理，给证据链根因、可修复。REPL、无头 CLI、Python 三形态。对标 SRE 的 𝐒𝐖𝐄-𝐛𝐞𝐧𝐜𝐡。局限：public alpha，API 在演进。 Tracer-Cloud/opensre t.co
10 projetos open source do GitHub para turbinar o seu fluxo de trabalho | Vol. 8 10 projetos open source do GitHub para turbinar o seu fluxo de trabalho, em contagem regressiva e com 10 segundos para cada um. Tem agentes de código rodando em paralelo, revisão automática entre agentes, câmeras que viram sensores do Home Assistant, vídeo com IA no seu computador e mais. 📺 Oitavo volume da série Open source do GitHub. Último commit conferido em 14/10/2026. Segue o canal e ativa as notificações para não perder a próxima. Qual desses você vai testar primeiro? Conta nos comentários! ⏱️ CAPÍTULOS E LINKS 0:00 Abertura 0:10 #10 diri: rode dezenas de agentes de código em paralelo, cada um no seu worktree cristicretu/diri 0:20 #9 DashLit: página inicial self-hosted para links e serviços, com status ao vivo codewec/dashlit 0:30 #8 zeroshot: quem escreve o código não aprova: outros agentes revisam antes do PR the-open-engine/zeroshot 0:40 #7 OpenBot: colegas de IA self-hosted, cada um com computador e navegador CopilotKit/openbot 0:50 #6 OpenSRE: monte agentes de IA de SRE que investigam falhas em produção Tracer-Cloud/opensre 1:00 #5 CLI-Anything: qualquer programa vira uma linha de comando para agentes (52 mil estrelas) HKUDS/CLI-Anything 1:10 #4 VisionState: IA local transforma câmeras em sensores do Home Assistant oleost/VisionState 1:20 #3 Rooms: cada projeto vira uma sala no Mac, com as janelas no lugar saragordic/rooms 1:30 #2 FreeVideo: vídeos com IA no seu computador, com modelos abertos FlashML-org/FreeVideo 1:40 Oferecimento Hallen Tech 1:54 #1 Claude Squad: vários agentes de código num terminal só smtg-ai/claude-squad 2:04 Encerramento 🧡 Oferecimento: Hallen Tech, liderança de tecnologia sob demanda, software, cloud e segurança para a sua empresa. Site: hallentech.com E-mail: contato@hallentech.com Instagram: instagram.com LinkedIn da Hallen Tech: linkedin.com LinkedIn do Eddwan: linkedin.com Se curtiu, deixa o like, segue o canal e ativa as notificações para a próxima lista. #opensource #github #inteligenciaartificial
おお、初めて見たけどこういう情報は有難いですね🙏 CodexやClaude Codeの入り口で止まってしまう方向けに初期設定ウィザードを試作公開してみたので良かったらみなさん使ってください！ ※改良続けるのでご意見歓迎です🙌 Katsuyasan88/AIProjectSetupWizard
OpenSRE: Build Your Own AI SRE Agents (12k stars) What it does All text below is quoted directly from the project README. >The open-source framework for AI SRE agents, and the training and evaluation environment they need to improve. Connect the 60+ tools you already run, define your own workflows, and answer production questions on your own infrastructure. Why OpenSRE? When something breaks in production, the evidence is scattered across logs, metrics, traces, runbooks, and Slack threads. OpenSRE is an open-source framework for AI SRE agents that resolve production incidents, built to run on your own infrastructure. OpenSRE is building that missing layer: >an open reinforcement learning environment for agentic infrastructure incident response, with end-to-end tests for realistic production failures We do that by: - building easy-to-deploy, customizable AI SRE agents for production operations and incident response - running real-world end-to-end tests across cloud-backed scenarios - keeping semantic test-catalog naming so e2e vs unit and local vs cloud boundaries stay obvious >Public Alpha: Core workflows are usable for early exploration, though not yet fully stable. The project is in active development, and APIs and integrations may evolve. Repository Tracer-Cloud/opensre Repository stats |Metric|Value| |:-|:-| |Stars|11,674| |Forks|1,709| |Last release|v0.1.2026.10.9 (2026-10-09)| |Languages|Python 99.6%| |Contributors|366| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|Claude: 215, Cursor: 290, Copilot: 27| |AI co-authored commits|Claude: 217, Codex: 1, Cursor: 299, Copilot: 35| Main contributor |Field|Value| |:-|:-| |Name|Vincent Hus| |GitHub|@davincios| |Commits to this repo|1,050 (top contributor)| |Bio|CEO @ OpenSRE 🏃| |Company / Location|opensre.com, London| |Website|discord.gg| |X / Twitter|@vincent_hus| |Followers|307| |Public repos|47| |On GitHub since|2017-10-29|
#每日推荐 让 AI 帮忙查线上故障 OpenSRE 是搭建 AI SRE 智能体的框架，可连接运维工具、定义排障流程，并提供训练和评测环境。目前处于 Public Alpha，适合试验探索。 Tracer-Cloud/opensre