Isolation of AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition →-executed code was tested by over a thousand reports. A guest-reachable kernel networking flaw could leak or compromise host memory, so microVM sandboxes still depend on upstream kernel patching.
Key takeaways · AI-distilled
Vercel's two-week public sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition →-escape challenge drew 1,285 reports, of which 57 were valid and 877 were duplicates. It paid out $242,000, and Vercel says no report showed anyone accessing customer data.
The top finding was a Linux kernel networking defect: crafted packets from inside a microVM leaked host memory, shown against production, and on the researcher's own matching KVM/Firecracker machines crashed the host or ran code with admin rights. Patches and CVEs are pending.
Trail of Bits spent four engineer-weeks with source access, filed 20 findings, judged the per-sandbox Firecracker microVM boundary sound, and recommended removing all trust in guest-supplied values, one decider per policy, and assuming the next zero day.
A day-one report showed the host trusted snapshot locations reported by the guest, letting a researcher swap snapshots between two accounts they owned. Targeting a stranger would need a secret 96-bit key; the fix binds snapshots to their project host-side.
In Vercel's internal assessment, an intern found a separate cross-tenant leak: the Linux device-mapper storage layer let any sandbox read recycled disk blocks from previously deleted sandboxes.
Terms in this piece · Glossary
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
