Loading story…
Vercel’s $1 million bug-bounty challenge for its Firecracker-based microVM sandbox received 1,285 reports and validated one Critical, seven High, 15 Medium, 49 Low, and 19 informational findings. The sandbox is used to isolate untrusted AI-agent code; Vercel had committed roughly $325,000 in rewards, and said no submission demonstrated access to real customer data.
The most serious reports disclosed two independent, nonpublic Linux kernel networking-stack flaws: one can expose host-kernel memory and the other can deterministically crash the host. Fixes remain under private review and CVE assignments are pending; the issues may affect cloud-isolation designs beyond Vercel. Trail of Bits also identified control-plane trust concerns involving values returned by guest microVM software, while Vercel used an agentic triage system to deduplicate reports and run researcher proof-of-concept exploits in a live sandbox.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Vercel ran a bug-bounty challenge for its Firecracker-based Sandbox environment, combining HackerOne black-box testing with Trail of Bits white-box testing. The program offered a $1 million reward pool and ran through September 1.
From 1,285 submitted reports, Vercel had validated one critical, seven high, 15 medium, 49 low, and 19 informational findings, with approximately $325,000 in committed payouts. No report demonstrated access to real Vercel customer data.
Facing the report volume, Vercel developed an agentic triage system using its Eve framework and Kimi K3, removing human review from the triage loop. The agent checks policy compliance, detects duplicates, retrieves source code, and runs researcher proofs of concept in a real Vercel Sandbox.
Trail of Bits produced 20 findings in its white-box assessment, including that Vercel's control plane accepted values returned by software inside guest microVMs. It recommended treating values crossing the guest boundary as tenant-controlled unless derived server-side or protected by a guest-inaccessible signing key.
Researchers identified two independent undisclosed Linux kernel networking-stack vulnerabilities: one could disclose host-kernel memory and the other could deterministically crash the host. Vercel said fixes were under private review and CVE assignments remained pending.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel has launched a two-week security challenge on HackerOne offering up to **$1 million** in total bounties for researchers who can break out of its sandbox environment. The company is inviting attempts to achieve compute-boundary and network-boundary escapes, including reaching the underlying EC2 host, crashing or accessing another tenant’s sandbox, bypassing the sandbox firewall, exfiltrating data, or obtaining credentials from the isolated environment. Vercel said the sandbox architecture relies on bare-metal EC2 hosts, **Firecracker microVMs** with dedicated guest kernels, and Linux containers running inside those microVMs, with the microVM acting as the primary security boundary. The highest single payout is **$50,000** for a validated flaw that enables access to or modification of another tenant’s data, and the company said it will patch and disclose successful findings. Vercel framed the initiative as a proactive response to recent AI agent containment failures involving OpenAI, Anthropic, and Meta, highlighting growing concern over sandbox security as AI systems become more capable.
Aug 21, 2026
Researchers disclosed a broad set of critical flaws in the `vm2` Node.js sandbox library that allow untrusted JavaScript to break isolation and execute arbitrary code on the host system. Reports describe 11 to 12 vulnerabilities affecting versions across the `3.9.6` to `3.11.1` range, with most rated `CVSS 9.8` to `10.0`, and impacting core protections such as built-in allowlists, object handling, prototype traversal, Promise species behavior, `util.inspect`, `Module._load()`, WebAssembly exception handling, and unsafe `nesting: true` configurations. One tracked issue, **CVE-2026-24118**, is a sandbox breakout through `__lookupGetter__` in versions prior to `3.11.0`, enabling host-level command execution with no privileges or user interaction. The disclosures reinforce long-running concerns that `vm2`'s JavaScript-only isolation model is not dependable for high-risk use cases such as multi-tenant code execution, plugin evaluation, automated grading, and serverless workloads. While some reports recommend upgrading to **vm2 `3.11.2`** for the latest protections, others note that **CVE-2026-44008** and **CVE-2026-44009** remain unpatched and argue that organizations handling untrusted code should consider stronger isolation boundaries such as containers or microVMs. Successful exploitation could expose environment variables, credentials, and files, and enable full compromise of the underlying Node.js host and potential lateral movement.
Jun 29, 2026
A wave of disclosures has exposed multiple critical flaws in the Node.js sandbox library **vm2**, showing that untrusted JavaScript can break out of the sandbox and execute commands on the host. GitHub advisories describe several distinct escape paths affecting versions as old as `3.9.6` and, in some cases, up to `3.11.3`, including a breakout through Node.js `inspect`, a Promise species bypass that defeats an earlier patch, prototype pollution through vm2’s bridge to host intrinsic prototypes, and a `NodeVM` misconfiguration path where `nesting: true` lets code bypass `require: false` and load `vm2` recursively to reach modules such as `child_process`. Public proof-of-concepts show attackers recovering the host `process` object and invoking host commands, turning vm2 from a containment boundary into a route to full host compromise. Additional reporting and upstream changes indicate the problems are broader than a single bug. Semgrep documented a new sandbox escape, while vm2 maintainers added regression tests covering descriptor- and prototype-traversal techniques used to recover host constructors such as `Function`, `AsyncFunction`, and `GeneratorFunction`, as well as callback sanitization bypasses tied to Promise handling. A later roundup described five critical vulnerabilities with no practical configuration-based workaround for deployments that execute untrusted code, and urged upgrades to **vm2 `3.11.4` or later**. The advisory backlog on the project’s GitHub page shows a concentrated set of newly published sandbox escape, builtin bypass, and host code execution issues, underscoring that organizations relying on vm2 for isolation should treat affected environments as potentially compromised.
Jun 29, 2026