Loading story…
Vercel confirmed a KVM zero-day after security researcher Paulos Yibelo reported a full virtual machine escape through its Vercel Sandbox bug bounty program. Yibelo said code running inside a guest could obtain root access on the host, and Vercel awarded him its maximum single-report bounty of $50,000. Vercel Sandbox runs untrusted workloads, including AI-agent code, in Firecracker microVMs on bare-metal Amazon EC2 hosts; the reported escape crosses the service’s primary isolation boundary.
The exploit chain, affected versions, prerequisites, CVE identifier, and patch status remain undisclosed, limiting independent assessment of exposure and remediation requirements. Vercel CEO Guillermo Rauch said a technical write-up would follow. The available statements do not establish customer data theft, widespread exploitation, or exposure across all KVM deployments. Security teams using Vercel Sandbox should monitor Vercel’s advisories for affected configurations and remediation guidance rather than assume the finding applies to every KVM environment.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Yibelo announced a claimed guest-to-host escape granting host root access and shared the bounty notification. The announcement did not disclose an exploit chain, CVE identifier, affected versions, exploitation prerequisites, or a patch.
Vercel opened its $1 million Sandbox challenge, requiring a live proof of concept demonstrating a broken security boundary rather than a finding based solely on code review.
Vercel CEO Guillermo Rauch separately confirmed a KVM zero-day and said a full technical write-up would follow. His statement did not establish that all KVM deployments, Firecracker installations, or cloud providers were vulnerable.
Vercel awarded Yibelo $50,000 for the vulnerability report, the Sandbox program's maximum single-report payment. The bounty notification later shared publicly did not reveal the root cause or establish that customer information had been accessed.
Paulos Yibelo submitted a vulnerability through the Vercel Sandbox bug bounty program that he said allowed code inside a guest virtual machine to obtain root access on its host.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel’s $1 million bug-bounty challenge for its Firecracker-based microVM sandbox received 1,285 reports and validated one Critical, seven High, 15 Medium, 49 Low, and 19 informational findings. The sandbox is used to isolate untrusted AI-agent code; Vercel had committed roughly $325,000 in rewards, and said no submission demonstrated access to real customer data. The most serious reports disclosed two independent, nonpublic Linux kernel networking-stack flaws: one can expose host-kernel memory and the other can deterministically crash the host. Fixes remain under private review and CVE assignments are pending; the issues may affect cloud-isolation designs beyond Vercel. Trail of Bits also identified control-plane trust concerns involving values returned by guest microVM software, while Vercel used an agentic triage system to deduplicate reports and run researcher proof-of-concept exploits in a live sandbox.
Sep 17, 2026
Vercel has launched a two-week security challenge on HackerOne offering up to **$1 million** in total bounties for researchers who can break out of its sandbox environment. The company is inviting attempts to achieve compute-boundary and network-boundary escapes, including reaching the underlying EC2 host, crashing or accessing another tenant’s sandbox, bypassing the sandbox firewall, exfiltrating data, or obtaining credentials from the isolated environment. Vercel said the sandbox architecture relies on bare-metal EC2 hosts, **Firecracker microVMs** with dedicated guest kernels, and Linux containers running inside those microVMs, with the microVM acting as the primary security boundary. The highest single payout is **$50,000** for a validated flaw that enables access to or modification of another tenant’s data, and the company said it will patch and disclose successful findings. Vercel framed the initiative as a proactive response to recent AI agent containment failures involving OpenAI, Anthropic, and Meta, highlighting growing concern over sandbox security as AI systems become more capable.
Aug 21, 2026
Broadcom has released emergency patches for **`CVE-2026-47876`**, a critical **out-of-bounds write** flaw in the **VMXNET3** virtual network adapter used by VMware ESX environments. The vulnerability, rated **CVSS 9.3** and mapped to **`CWE-787`**, allows an attacker with **local administrator or root privileges inside a guest VM** using VMXNET3 to execute code on the underlying host, creating a **guest-to-host escape** condition. Affected offerings include **VMware ESX**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform** across specified version ranges. Broadcom said there is **no evidence of active exploitation**, no complete workaround, and no published indicators of compromise, increasing pressure on defenders to apply vendor fixes quickly. Security researchers warned that successful exploitation could break VM isolation and expose the hypervisor, adjacent virtual machines, management systems, workloads, and infrastructure secrets, particularly in multi-tenant environments. The flaw was privately reported by **Nguyen Hoang Thach of STARLabs SG** through **Pwn2Own** and the **Zero Day Initiative**, and organizations are being urged to patch affected builds immediately and treat any privileged compromise of a VMXNET3-enabled guest on an unpatched host as a potential hypervisor incident.
Aug 1, 2026