Loading story…
Vercel has launched a two-week security challenge on HackerOne offering up to $1 million in total bounties for researchers who can break out of its sandbox environment. The company is inviting attempts to achieve compute-boundary and network-boundary escapes, including reaching the underlying EC2 host, crashing or accessing another tenant’s sandbox, bypassing the sandbox firewall, exfiltrating data, or obtaining credentials from the isolated environment.
Vercel said the sandbox architecture relies on bare-metal EC2 hosts, Firecracker microVMs with dedicated guest kernels, and Linux containers running inside those microVMs, with the microVM acting as the primary security boundary. The highest single payout is $50,000 for a validated flaw that enables access to or modification of another tenant’s data, and the company said it will patch and disclose successful findings. Vercel framed the initiative as a proactive response to recent AI agent containment failures involving OpenAI, Anthropic, and Meta, highlighting growing concern over sandbox security as AI systems become more capable.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Vercel announced a two-week security challenge offering up to $1 million in total bounties for researchers to try to break out of its sandbox environment. The program invites attempts at compute-boundary escapes, cross-tenant access, sandbox crashes, firewall bypasses, data theft, and credential access, with up to $50,000 for a validated issue affecting another tenant's data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel’s $1 million bug-bounty challenge for its Firecracker-based microVM sandbox received 1,285 reports and validated one Critical, seven High, 15 Medium, 49 Low, and 19 informational findings. The sandbox is used to isolate untrusted AI-agent code; Vercel had committed roughly $325,000 in rewards, and said no submission demonstrated access to real customer data. The most serious reports disclosed two independent, nonpublic Linux kernel networking-stack flaws: one can expose host-kernel memory and the other can deterministically crash the host. Fixes remain under private review and CVE assignments are pending; the issues may affect cloud-isolation designs beyond Vercel. Trail of Bits also identified control-plane trust concerns involving values returned by guest microVM software, while Vercel used an agentic triage system to deduplicate reports and run researcher proof-of-concept exploits in a live sandbox.
Sep 15, 2026
Researchers at **Pwn2Own Berlin 2026** earned **$523,000** on the first day after demonstrating **24 unique zero-day vulnerabilities** against fully patched targets spanning browsers, operating systems, AI platforms, and NVIDIA-related infrastructure. The standout exploit came from **Orange Tsai** of **DEVCORE Research Team**, who chained **four logic bugs** to escape the **Microsoft Edge** sandbox and collected **$175,000**. **Windows 11** was also successfully compromised three times through separate local privilege-escalation zero-days, underscoring continued risk in core desktop platforms. Other successful demonstrations targeted **Red Hat Linux for Workstations**, **NVIDIA Container Toolkit**, **NVIDIA Megatron Bridge**, **LiteLLM**, **Chroma**, **OpenAI Codex**, and **LM Studio**, showing that enterprise AI tooling was a major attack surface at the event. Some attempts, including attacks against **Oracle Autonomous AI Database** and one **OpenAI Codex** entry, failed, but AI products still featured prominently as the competition’s enterprise-and-AI theme drove testing. After day one, **DEVCORE Research Team** led the standings with **$205,000**, and disclosed bugs now move into the contest’s **90-day vendor remediation window**.
Jun 29, 2026
Anthropic introduced real-time cyber safeguards for its Claude Opus and Sonnet models that automatically block prompts tied to prohibited or high-risk cyber activity, including mass data exfiltration and ransomware development. The company said some dual-use requests, such as vulnerability exploitation or offensive security tooling, may still be permitted through its application-based Cyber Verification Program, which is intended for vetted defensive security professionals and is not currently available for Zero Data Retention users or through Amazon Bedrock and Google Vertex AI. Anthropic also launched a HackerOne program to reward researchers who find high-impact jailbreaks that let Claude Fable 5 generate exploit code, malware, or detailed attack guidance it would normally refuse. The moves come amid broader industry concern that advanced models can sharply reduce the time and skill needed for offensive cyber work, while related reporting tied Anthropic’s vulnerability-discovery efforts to IBM and Red Hat’s new **Project Lightwell**, a $5 billion service aimed at backporting and delivering signed fixes for open-source flaws uncovered faster than enterprises can patch them.
Jul 3, 2026