Vercel Sandbox security review: Isolation limits for AI-generated code

Vercel Sandbox architecture and the 2026 hacker challenge

Vercel Sandbox runs untrusted or AI-generated code inside Firecracker-based Linux microVMs. Administrators can apply egress network policies that restrict outbound connections to approved domains through SNI filtering. The service launched a $1 million bug bounty in August 2026 that lasted roughly two weeks and received 1,285 reports, resulting in $242,000 paid out. A parallel Trail of Bits architecture review added 20 confirmed findings after four engineer-weeks of work.

No submission in the challenge reached customer data, files, or secrets. The virtualization boundary itself received a positive assessment because each sandbox uses a dedicated guest kernel and a minimal device model. Recommendations from the review, including reduced guest trust and disabled nested virtualization, have been implemented.

Kernel-level and network policy findings

One critical discovery involved an upstream Linux kernel networking zero-day. Crafted packets sent from inside a microVM could leak host memory, crash the host after only two packets, and achieve code execution with administrative privileges. The issue affects any KVM or Firecracker deployment and remains under private review with kernel maintainers.

A separate internal finding identified a cross-tenant leak through the Linux device-mapper storage layer. An intern demonstrated that deleted sandbox disk blocks could be read from recycled storage; the flaw was corrected before public disclosure. In October 2026, researchers at AIR Security published VerCellBreak, a network policy bypass that embeds exfiltration data inside an mTLS certificate’s AIA extension URL. The technique relies on standard TLS behavior during certificate validation and does not require a server-side vulnerability. Vercel marked the report out of scope for the bounty program.

These issues highlight shared infrastructure risks that affect many cloud providers using similar kernel and storage components. No evidence of in-the-wild exploitation has been reported for any of the findings.

April 2026 incident and ongoing user guidance

An unrelated April 2026 compromise originated from a third-party AI tool used by a Vercel employee. Attackers obtained limited internal access through a supply-chain compromise at Context.ai and pivoted via Google Workspace. Only non-sensitive environment variables for a subset of customers were potentially exposed; customers received rotation notices and remediation concluded by mid-October 2026.

Vercel advises users to enforce network policies, mark sensitive environment variables, and watch for upcoming kernel patches. The company continues to run an active HackerOne program for Sandbox. Organizations evaluating the service for AI agent workloads should weigh the remaining TLS-based exfiltration path and kernel exposure against the absence of confirmed customer data incidents to date.