$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

Summary

Vercel's two-week bug bounty program, offering a $1 million reward, received 1,285 reports, many AI-assisted. While no customer data was compromised, the challenge uncovered critical vulnerabilities in the Linux kernel's networking stack, impacting cloud providers. Vercel also developed an AI agent to automate vulnerability triage due to the high volume of reports.

Full text

A two-week focused sandbox bug-bounty program resulted in 1,285 filings, but none that could access customer data. The Vercel sandbox, a Firecracker‑based microVM environment, is an isolation tool for untrusted AI‑agent code. For two weeks (August 18 until September 1), Vercel operated a focused bug-bounty program with a $1 million reward pot. It called the program a ‘challenge’ – a challenge to HackerOne hackers (black box targeting) and Trail of Bits engineers (white box targeting) to escape the sandbox. Time is up, and the results have been published. Vercel received 1,285 reports in two weeks, demonstrating the modern power and speed of researchers working with AI-assistance. “Report triage runs until October 1, but so far we have validated 1 Critical, 7 High, 15 Medium, 49 Low, 19 Informative. ~$325k in committed payouts,” says the firm. None of the reports showed anyone being able to access a real customer’s data – but many have allowed Vercel to improve the product. The most important filing found two independent defects in the Linux kernel’s networking stack (not Vercel’s own code). One leaks memory from the host’s kernel, while the other crashes the host, deterministically. These flaws have wide implications since many major cloud providers isolate customer workloads using the same layer of the Linux kernel. Because of the bounty, Vercel learned about the flaws two weeks ahead of the kernel maintainers. “The fixes are under private review and CVEs are pending, so we are keeping details out of this post until they are public,” reports Vercel. The white box testing by two Trail of Bits engineers produced 20 findings; but Vercel got most value from their architectural advice. While agreeing with Vercel’s choice of the virtualization, they made three structural recommendations; for example, ’stop trusting the guest’.Advertisement. Scroll to continue reading. “Our control plane accepted values returned by software running inside the microVM. Every one of those values is tenant input. Anything that crosses the boundary should be derived server-side or signed with a key the guest cannot reach,” explains Vercel. The sheer volume of reports presented a separate challenge. Vercel started its report triaging using one chat for each report with a human reviewing every decision. “That MVP was the right call for the first fifty reports, and the wrong one for the next thousand.” As the volume increased, Vercel developed its own agentic triaging solution with an agent built on the Vercel Eve agent framework. The new agent reads each report, checks it against the program policy, hunts for duplicates across a thousand filings, pulls our source trees, and runs the researcher’s proof of concept inside a real Vercel Sandbox. Vercel plans to open source this agent running on Kimi K3. While the volume of reports received in this bug bounty program is spurred by the program itself, it is indicative of the way in which security alerts for everything are likely to increase, courtesy of AI, in the coming months – and Vercel’s open source alert triaging code could be a useful starting point for other firms. But two further features are noteworthy. Firstly, and not surprisingly, Vercel concluded that you need AI defense to counter the speed of AI attack. More noteworthy, however, they pulled the human from the loop. This is a big debate in security. Customers want the confidence of human decision-making over automated decision-making. Security product developers are continuing to oblige. But a human in the loop will inevitably add latency to the security response. In many cases this latency is acceptable, but as everything speeds up, it may become unacceptable, and potentially disastrous. In this instance, Vercel is both the supplier and the customer, and had sufficient confidence in the agent to remove the human in the loop to improve the speed of the process. There may be a lesson for the future in this. The Vercel bug bounty challenge can be considered a success. Its analysis of the result can benefit everyone. But for Vercel it demonstrated the strength of its sandbox. Not one of the attackers, we are told, could gain access to customer data, while the submitted findings have helped the firm improve rather than repair the product.. “Our sandbox… is permanently better now… Every technique discovered during these two weeks becomes a part of how we defend the boundary, protecting every workload running on Vercel long after the challenge closed.” But one final word of warning: lack of proof of any weakness does not prove a lack of any weakness: not finding a vulnerability does not mean there is no vulnerability. This applies to everything, everywhere. Related: Anthropic Silently Patches Claude Code Sandbox Bypass Related: Critical N8n Sandbox Escape Could Lead to Server Compromise Related: Chrome Sandbox Escape Earns Researcher $250,000 Written By Kevin Townsend Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Kevin Townsend The Race to Control AI and Protect What Makes Us HumanCISOs Race to Control AI Agents Without Destroying Their ValuePhishing Research Challenges Conventional Security Awareness TestingKiteworks Acquires Bonfy.AI to Fill the AI Gap in Data GovernanceHacker Conversations: Vinnie Liu, Performer Turned RingmasterDeceptive Android Apps Exploit Google Play Early Access to Evade ReviewsAI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google WarnsUS Agencies Warn China Is Systematically Extracting Frontier AI Capabilities Latest News Exein Secures $270M at $1.7B Valuation for Physical AI SecurityTexas Utility CenterPoint Energy Confirms Breach After Hacker Leaks DataThai Broadband Provider Hacked via Fortinet VulnerabilityOpenAI Investigates Report Linking AI Agents to RubyGems Attack240,000 Hit by Data Breach at Japan’s Digital AgencyApple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety ConstraintsHacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveZero Networks has named Yossi Dagan as Chief Financial Officer.Manifold has appointed Joe Sullivan to its Board of Directors.Patrick McKinney has joined Turing as Chief Information Security Officer.More People On The MoveExpert Insights This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty

Indicators of Compromise

• mitre_attack — T1071.001

Entities