$1 million hacker challenge for Vercel Sandbox

Vercel's Sandbox challenge treated isolation as two separate boundaries: the virtual machine containing untrusted code and the network controls governing where that code can connect. A network bypass could qualify even without escaping the virtual machine. Merely leaving the inner container for its guest operating system was outside the challenge's scope. Challenge announcement.

The announced window ran from August 18 to September 1, 2026, with a total reward pool of up to $1 million and a maximum of $50,000 per report. The design lesson outlasts that window: containing execution and restricting communication need separate testing. The announcement describes the planned challenge and its boundaries, rather than establishing what vulnerabilities researchers ultimately found.