Vercel launches public bounty to test sandbox escape

Vercel has launched a public HackerOne bug bounty programme focused on the security boundary of its Vercel Sandbox. It has set aside up to USD $1 million in total payouts for researchers who can escape the sandbox.

The programme targets the isolation model used by Vercel Sandbox, including the Firecracker microVM and the network firewall on the host outside the microVM. It is intended to test the containment boundary for workloads running untrusted code.

The move comes as scrutiny of sandboxing and containment systems grows across the artificial intelligence and cloud infrastructure sectors. Recent research and security incidents have raised questions about whether virtual machine boundaries alone are enough to stop code from reaching a host system or another customer environment.

Under the bounty structure, researchers can earn up to USD $50,000 for a single report if they demonstrate a vulnerability that would allow a threat actor to read or modify another Vercel tenant's data. The total reward pool is capped at USD $1 million, with payouts made per report and assigned according to the maximum demonstrable impact of a single root cause.

Vercel Sandbox runs on bare-metal EC2 hosts. Each sandbox uses its own Firecracker microVM with a dedicated guest kernel, and a Linux container inside that microVM executes customer code.

According to Vercel, the microVM, not the container, is the security boundary. Code supplied by an operator is therefore assumed to be hostile, including code with root access inside the container and full kernel access inside the microVM.

Isolation design

Network controls are enforced on the host outside the microVM, where code running in the sandbox cannot alter or disable them. The firewall intercepts outbound TCP and DNS traffic, checks each connection against domain and CIDR policies, and can inject credentials at the boundary so they do not enter the microVM.

The architecture reflects a broader shift in how infrastructure providers think about isolation for agent-based systems and other environments that execute untrusted code. In those settings, the challenge is not only preventing a direct escape from a virtual machine, but also stopping software from exploiting network paths not considered part of the threat model.

Vercel is opening the exercise to the wider HackerOne research community rather than limiting it to private testing. It said it would publish a public write-up after the challenge window closes, covering what was broken, who found it and what was fixed, regardless of the outcome.

The announcement signals a more public approach to infrastructure assurance at a time when providers are under pressure to show that their containment claims can withstand independent scrutiny. Bug bounty programmes are common for web applications and APIs, but a focused public challenge on sandbox escape routes puts the isolation layer itself under examination.

For companies building tools that rely on code execution, that layer has become more important as autonomous agents and developer tools gain broader permission to run generated or third-party code. A failure in the boundary between one workload and another can expose customer data, host systems or credentials that should remain outside the guest environment.

Explaining the rationale, Vercel framed the exercise as a choice between internal reassurance and external testing. "Either the boundary gets tested on an attacker's schedule, or on ours, in the open, with the best researchers in the world," the company said.

It also placed the challenge in the context of a changing security landscape around AI systems. "The gap between offensive and defensive AI capability is closing, not holding steady, and Vercel believes companies need to close the gap before attackers find it first," the company said.

The reward structure suggests Vercel expects researchers to focus on practical impact rather than theoretical weaknesses. By tying the top single-report payout to a finding that lets an attacker read or modify another tenant's data, the programme centres on cross-tenant isolation, one of the most sensitive risks in multi-tenant cloud systems.

Vercel said it is "proactively choosing to test Vercel Sandbox on their own schedule, not an attacker's, and are doing it in the open, with the best researchers in the world."