A two-week focused sandbox bug-bounty program resulted in 1,285 filings, but none that could access customer data.
The Vercel sandbox, a Firecracker‑based microVM environment, is an isolation tool for untrusted AI‑agent code. For two weeks (August 18 until September 1), Vercel operated a focused bug-bounty program with a $1 million reward pot. It called the program a ‘challenge’ – a challenge to HackerOne hackers (black box targeting) and Trail of Bits engineers (white box targeting) to escape the sandbox.
Time is up, and the results have been published. Vercel received 1,285 reports in two weeks, demonstrating the modern power and speed of researchers working with AI-assistance. “Report triage runs until October 1, but so far we have validated 1 Critical, 7 High, 15 Medium, 49 Low, 19 Informative. ~$325k in committed payouts,” says the firm. None of the reports showed anyone being able to access a real customer’s data – but many have allowed Vercel to improve the product.
The most important filing found two independent defects in the Linux kernel’s networking stack (not Vercel’s own code). One leaks memory from the host’s kernel, while the other crashes the host, deterministically. These flaws have wide implications since many major cloud providers isolate customer workloads using the same layer of the Linux kernel. Because of the bounty, Vercel learned about the flaws two weeks ahead of the kernel maintainers.
“The fixes are under private review and CVEs are pending, so we are keeping details out of this post until they are public,” reports Vercel.
The white box testing by two Trail of Bits engineers produced 20 findings; but Vercel got most value from their architectural advice. While agreeing with Vercel’s choice of the virtualization, they made three structural recommendations; for example, ’stop trusting the guest’.
“Our control plane accepted values returned by software running inside the microVM. Every one of those values is tenant input. Anything that crosses the boundary should be derived server-side or signed with a key the guest cannot reach,” explains Vercel.
The sheer volume of reports presented a separate challenge. Vercel started its report triaging using one chat for each report with a human reviewing every decision. “That MVP was the right call for the first fifty reports, and the wrong one for the next thousand.” As the volume increased, Vercel developed its own agentic triaging solution with an agent built on the Vercel Eve agent framework.
The new agent reads each report, checks it against the program policy, hunts for duplicates across a thousand filings, pulls our source trees, and runs the researcher’s proof of concept inside a real Vercel Sandbox. Vercel plans to open source this agent running on Kimi K3. While the volume of reports received in this bug bounty program is spurred by the program itself, it is indicative of the way in which security alerts for everything are likely to increase, courtesy of AI, in the coming months – and Vercel’s open source alert triaging code could be a useful starting point for other firms.
But two further features are noteworthy. Firstly, and not surprisingly, Vercel concluded that you need AI defense to counter the speed of AI attack. More noteworthy, however, they pulled the human from the loop. This is a big debate in security. Customers want the confidence of human decision-making over automated decision-making. Security product developers are continuing to oblige. But a human in the loop will inevitably add latency to the security response. In many cases this latency is acceptable, but as everything speeds up, it may become unacceptable, and potentially disastrous.
In this instance, Vercel is both the supplier and the customer, and had sufficient confidence in the agent to remove the human in the loop to improve the speed of the process. There may be a lesson for the future in this.
The Vercel bug bounty challenge can be considered a success. Its analysis of the result can benefit everyone. But for Vercel it demonstrated the strength of its sandbox. Not one of the attackers, we are told, could gain access to customer data, while the submitted findings have helped the firm improve rather than repair the product..
“Our sandbox… is permanently better now… Every technique discovered during these two weeks becomes a part of how we defend the boundary, protecting every workload running on Vercel long after the challenge closed.”
But one final word of warning: lack of proof of any weakness does not prove a lack of any weakness: not finding a vulnerability does not mean there is no vulnerability. This applies to everything, everywhere.
Related: Anthropic Silently Patches Claude Code Sandbox Bypass
Related: Critical N8n Sandbox Escape Could Lead to Server Compromise
