VERCEL’S two-week, $1 million sandbox bug-bounty challenge generated 1,285 reports between 18 August and 1 September. The programme invited HackerOne researchers to conduct black-box testing and Trail of Bits engineers to perform white-box reviews of Vercel’s Firecracker-based microVM environment, which isolates untrusted AI-agent code. Vercel said it had so far validated one Critical, seven High, 15 Medium, 49 Low and 19 Informative findings, with about $325,000 in payouts committed. None demonstrated access to real customer data, although the findings led to improvements to the sandbox.
The most significant discovery involved two independent flaws in the Linux kernel’s networking stack rather than Vercel’s own code. One can leak host-kernel memory and the other can deterministically crash the host. Vercel said the issues may affect other cloud providers that use the same Linux isolation layer, and that it notified kernel maintainers two weeks before public disclosure. Fixes were under private review and CVEs were pending, so technical details were withheld.
Trail of Bits produced 20 findings and advised Vercel to stop trusting values returned by guest software: data crossing the microVM boundary should instead be derived server-side or signed with a key unavailable to the guest. Faced with the volume of submissions, Vercel developed an agent-based triage system that checks policy compliance, identifies duplicates, retrieves source code and runs proof-of-concept exploits in a real sandbox. The company plans to open-source the tool, built on its Eve agent framework and Kimi K3.