Why Vercel is paying for a sandbox escape
Running untrusted code inside a microVM has become the default isolation model for agent workloads. The pattern looks solid on paper: a dedicated guest kernel per workload, separated from the host and from every other workload on the same machine. But recent security research has made one thing clear — the VM boundary is not the only line of defense that matters. If the network path is not part of the security model, the sandbox is only half a sandbox.
Vercel's own CTO recently pointed an open-weight model with no safety guardrails at Vercel Sandbox. The model did not escape, but it did map the guest kernel, built a VM to test its hypotheses, and wrote a fuzzer. That kind of activity is a reminder that the defender's first-mover advantage erodes over time. Rather than wait for an attacker to find the weak spot on their own schedule, Vercel is running the test in the open — with up to $1,000,000 USD on the line.
Challenge details
The program is a two-week public HackerOne engagement running from Tuesday, August 18 to Tuesday, September 1, 2026, or earlier if the reward pool is exhausted. The pool is capped at $1,000,000 USD, and the maximum payout per report is $50,000 USD.
Bounties are paid per report, scoped to a single root cause, and awarded based on the maximum demonstrable impact as judged by Vercel triage. The full bounty table, detailed scope, and the list of known-duplicate classes are published on the HackerOne program page. Reports must include a live proof of concept — static-analysis-only findings will not be paid.
How the sandbox is put together
Vercel Sandbox runs on bare-metal EC2 hosts. Each workload gets its own Firecracker microVM with a dedicated guest kernel. A Linux container inside that microVM executes the operator's code. The microVM is the security boundary, not the container, so tenant code runs two layers removed from the host.
The threat model assumes the code is fully hostile: root inside the container, full kernel access inside the microVM, and motivated to reach the host or another tenant. The network side of the boundary is enforced on the host, outside the microVM, where in-sandbox code cannot alter or disable it. The firewall intercepts outbound TCP and DNS traffic, checks each connection against the operator's domain and CIDR policies, and can inject credentials at the boundary so they never enter the microVM.
What counts as a finding
The scope covers anything that breaks the sandbox boundary, in two areas:
- Compute boundary: Escaping the Firecracker microVM to the EC2 host, reaching another tenant's sandbox through the compute layer (reading, modifying, or executing code in it), or crashing another tenant's sandbox from within another sandbox
- Network boundary: Defeating the sandbox firewall without crossing the microVM: reaching destinations the operator did not authorize, exfiltrating data, or retrieving brokered credentials
Container namespace escapes that only reach the Firecracker guest OS are explicitly out of scope. Namespaces are treated as a developer-experience feature, not part of the security boundary.
Bounty tiers
Severity | Bounty |
|---|---|
Critical | $25,000 – $50,000 |
High | $10,000 – $25,000 |
Medium | $5,000 – $10,000 |
Low | $1,000 – $5,000 |
Example vulnerability classes for each tier are listed on the HackerOne program page, along with the complete payout structure.
How to participate
The program is open to all eligible researchers through the HackerOne program page. To reproduce a finding, boot a sandbox with the @vercel/sandbox SDK and demonstrate the impact with a live proof of concept. The default sandbox OS is sufficient for most reports; a custom image from the Vercel Container Registry should only be used if the PoC requires extra tooling.
Full rules, eligibility requirements, and the submission process are available on the program page.
Post-program plans
Triage runs from the opening day through one month after the program closes. As findings are confirmed, Vercel will pay bounties, ship fixes, and credit every researcher whose report holds up. Techniques discovered during the program will be folded into the sandbox boundary permanently. After the window closes, Vercel plans to publish a follow-up writeup covering the techniques found and the fixes deployed.
