Vercel's $1M Sandbox challenge produced 1,285 reports and a Linux kernel zeroday

Vercel launched the challenge in August, inviting security researchers to try to escape Vercel Sandbox, and coordinated with Trail of Bits to review the source code and security architecture. The challenge produced 1,285 reports over two weeks and $242,000 in bounties paid out. Vercel says no reports showed anyone accessing customer data in Vercel Sandbox.

The most serious finding came from Paulos Yibelo, a HackerOne researcher, who found a defect in the Linux kernel's networking stack. Crafted packets sent from inside the microVM enabled three attacks: leaking host memory over the network, crashing the host machine, and executing code on the host. The memory leak was demonstrated against Vercel production sandboxes, while the crash and code execution were shown on the researcher's own KVM and Firecracker machines matching the Sandbox configuration.

Vercel says fixes are under private review with CVEs pending, so it is not publishing further details until patches are public. Trail of Bits spent four engineer-weeks in the source code and delivered 20 findings, and its architectural review concluded the virtualization boundary is sound. Vercel says it implemented three structural recommendations, including removing trust in values returned by guest software and consolidating egress policy enforcement.

Almost every major cloud provider isolates customer workloads on the same kernel layer, so a defect there is shared-infrastructure risk for anyone running agent-generated code. Builders should watch for the kernel patches and CVEs once they are public and confirm that their sandbox provider has applied them.

Teams should not treat host isolation in a sandbox as settled, and should consider how untrusted code running inside a sandbox could reach shared host resources.