Loading story…
AIR researchers discovered a network-filtering vulnerability in Vercel Sandbox that could allow rogue AI agents to leak sensitive information despite outbound network allowlists. The technique uses a crafted digital certificate sent to an approved server to trigger a request from that server to an attacker-controlled destination. This creates an indirect exfiltration route without requiring the sandbox to contact the unauthorized destination itself, undermining the network restrictions intended to contain agents.
AIR notified Vercel, which reportedly said it needed time to determine how to patch the flaw; no available fix was reported in the October 13 coverage. Researchers described the vulnerability as apparently longstanding and found no evidence of exploitation in the wild, although they could not rule it out. Organizations running AI agents in Vercel Sandbox should review agents’ access to sensitive information and avoid treating network allowlists alone as a sufficient barrier against data exfiltration.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
According to AIR co-founder and CTO Niv Hoffman, Vercel said it needed time to develop a patch because the remediation approach was unclear. The report did not identify an available fix.
AIR contacted Vercel about the network-filtering vulnerability before the news report was published.
AIR researchers demonstrated that a crafted digital certificate sent to an approved server could cause that server to contact an attacker-controlled destination. The technique could indirectly exfiltrate sensitive information while the sandbox's own connections remain within its network allowlist.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel’s $1 million bug-bounty challenge for its Firecracker-based microVM sandbox received 1,285 reports and validated one Critical, seven High, 15 Medium, 49 Low, and 19 informational findings. The sandbox is used to isolate untrusted AI-agent code; Vercel had committed roughly $325,000 in rewards, and said no submission demonstrated access to real customer data. The most serious reports disclosed two independent, nonpublic Linux kernel networking-stack flaws: one can expose host-kernel memory and the other can deterministically crash the host. Fixes remain under private review and CVE assignments are pending; the issues may affect cloud-isolation designs beyond Vercel. Trail of Bits also identified control-plane trust concerns involving values returned by guest microVM software, while Vercel used an agentic triage system to deduplicate reports and run researcher proof-of-concept exploits in a live sandbox.
Sep 17, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026