AgentsAugust 11, 2026via Vercel Blog
A sandbox without a network boundary is only half a sandbox
Why it matters
Vercel articulates a critical security architecture pattern for agent deployment: egress control (what untrusted code can reach) is as essential as compute isolation (what it can access locally). Recent research shows agents can exfiltrate data or receive commands through network paths even when the VM boundary holds, making network policy a baseline requirement, not an add-on.
Key signals
- Agent security requires dual boundaries: compute isolation + egress control
- Prompt injection can instruct generated code to exfiltrate data without escaping the microVM if outbound traffic is unrestricted
- DNS resolvers, proxies, and identity services are attack vectors if left unaccounted for in the security model
- Vercel Sandbox implements host-level firewall with domain rules, CIDR policies, and dynamic credential injection (credentials never stored in sandbox)
- Credentials injected at network boundary (TLS termination) rather than in environment variables prevents exfiltration and limits scope to configured destinations
- Request forwarding enables custom policy layers (audit, authorization, supply-chain scanning) outside the sandbox
- Full egress firewall now available on all Vercel Sandboxes (no paywall for security baseline)
- Policy can be updated live without restarting the workload
The hook
Compute isolation alone isn't enough. As AI agents gain code execution and file access, the network boundary becomes part of the security perimeter—and most sandboxes are missing it.
Running untrusted code safely requires more than separating it from the host. You also have to control what that code can reach.
This matters more as AI agents gain the ability to read files, execute commands, install packages, and generate programs of their own. A microVM can prevent that code from…