$1 million hacker challenge for Vercel Sandbox
$1M. That's what Vercel is paying to hackers who can break out of its sandbox — the infrastructure agents need to run untrusted code safely.
Why it matters
Vercel is proactively testing the security boundaries of its microVM-based sandbox for agentic workloads, surfacing a critical gap in the agent infrastructure: network isolation failures can bypass VM boundaries. This public challenge reveals how seriously the industry is taking sandbox escape risks as agents move into production.
The key facts
8 to knowVercel Sandbox runs on Firecracker microVMs with dedicated guest kernels per workload
$1M total bounty pool, up to $50K per report, open Aug 18–Sep 1, 2026
Critical vulnerabilities: $25K–$50K; High: $10K–$25K; Medium: $5K–$10K; Low: $1K–$5K
In-scope: escaping microVM to EC2 host, reaching other tenant sandboxes, defeating firewall without crossing VM boundary
Security model assumes fully hostile code: root in container, full kernel access in microVM
Network boundary enforced on host outside microVM; firewall intercepts TCP, DNS, can inject credentials at boundary
Proof-of-concept required; static-analysis findings not eligible
Vercel CTO previously tested with open-weight model, mapped guest kernel, built fuzzer — found no escapes but validated attack surface
Go to the source
Vercel Blogvercel.com
Publisher excerpt: Agents need to run untrusted code, and the microVM has become the standard way to do it: a dedicated guest kernel per workload, isolated from the host and from every other workload on the same machine. But recent security research and real-world incidents have revealed that agents running untrusted…