Findings from the $1M Vercel Sandbox challenge
- Source
- vercel.com
- Author
- Andy Riancho
- Date
Vercel put $1M on the table for anyone who could escape Vercel Sandbox, the isolation layer it sells for running agent-generated and untrusted code. The challenge produced 1,285 reports and $242,000 in paid bounties. The most serious result was a zero-day in the Linux kernel's networking code that a guest inside a microVM could reach. According to Vercel, it allowed the guest to leak host memory, crash the host, or execute code, and the company says it found no evidence that customer data was accessed. The lesson for teams running coding agents is that a microVM boundary is only as strong as the host kernel underneath it. A separate talk in today's intake from Coder's Jiachen Jiang makes the same point from the operator side: written instructions are not boundaries, so isolation, short-lived credentials and audit logs the agent cannot edit carry the weight. If you self-host microVM sandboxes, kernel patch cadence belongs in the same review as the sandbox configuration itself.
Context
Vercel reports that a snapshot flaw let a researcher restore files across two accounts they controlled. The host had trusted storage information supplied from inside the , where untrusted code could alter it. Targeting an arbitrary victim would also have required that victim's private snapshot identifier. The findings report preserves that distinction.
The fix binds snapshots to their originating project and moves snapshot creation into a host-side service. This result from the August security challenge illustrates why isolation must include the services that accept information from a sandbox.
- Vercel's two-week public sandbox-escape challenge drew 1,285 reports, of which 57 were valid and 877 were duplicates. It paid out $242,000, and Vercel says no report showed anyone accessing customer data.
- The top finding was a Linux kernel networking defect: crafted packets from inside a microVM leaked host memory, shown against production, and on the researcher's own matching KVM/Firecracker machines crashed the host or ran code with admin rights. Patches and CVEs are pending.
- Trail of Bits spent four engineer-weeks with source access, filed 20 findings, judged the per-sandbox Firecracker microVM boundary sound, and recommended removing all trust in guest-supplied values, one decider per policy, and assuming the next zero day.
- A day-one report showed the host trusted snapshot locations reported by the guest, letting a researcher swap snapshots between two accounts they owned. Targeting a stranger would need a secret 96-bit key; the fix binds snapshots to their project host-side.
- In Vercel's internal assessment, an intern found a separate cross-tenant leak: the Linux device-mapper storage layer let any sandbox read recycled disk blocks from previously deleted sandboxes.
- sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
Checking sign-in…
Loading comments…