Vercel $1M sandbox challenge uncovers Linux kernel bugs

Vercel ran a focused, two-week sandbox challenge from August 18 to September 1 that offered a $1 million reward pool. The program targeted escapes from Vercel’s Firecracker-based microVM sandboxes that isolate untrusted AI-agent code and drew 1,285 reports.

The company is triaging submissions through October 1 and has validated 1 Critical, 7 High, 15 Medium, 49 Low and 19 Informative findings, with about $325,000 in committed payouts. Vercel reported that none of the validated reports showed access to customer data and that many findings helped harden the service.

The two most serious issues traced to the Linux kernel networking stack rather than Vercel’s code. One defect can leak memory from the host kernel and the other can deterministically crash the host. Vercel notified kernel maintainers roughly two weeks before public disclosure; fixes are under private review and CVEs are pending.

Trail of Bits performed white-box testing and produced 20 findings along with architectural recommendations. The outside team agreed with Vercel’s use of Firecracker but urged structural changes to the control plane. Vercel summarized the advice with the outside team’s observation: “Our control plane accepted values returned by software running inside the microVM. Every one of those values is tenant input. Anything that crosses the boundary should be derived server-side or signed with a key the guest cannot reach.”

Vercel initially triaged reports with a human reviewer in a dedicated chat for each filing, a process that did not scale as reports increased. The company developed an agentic triage system built on its Eve agent framework. The agent reads each submission, checks policy, searches for duplicates across filings, pulls source trees and runs researchers’ proofs-of-concept inside real Vercel Sandboxes.

The triage agent runs on Kimi K3 hardware and Vercel plans to open-source the tool. The company removed humans from parts of the triage loop to speed processing, automating some decisions that had required human review.

Vercel described the challenge as useful for verification and product improvement and wrote: “Our sandbox… is permanently better now… Every technique discovered during these two weeks becomes a part of how we defend the boundary, protecting every workload running on Vercel long after the challenge closed.” The company added that the absence of an exploit that accessed customer data does not prove there are no undiscovered vulnerabilities.