Vercel's $1 Million Sandbox Challenge Turned Up Linux Kernel Bugs Nobody Knew About
A two-week public hacking contest aimed at Vercel's AI code sandbox drew 1,285 submissions and uncovered two serious Linux kernel bugs that affect far more than one company.
Key points
- Vercel ran a two-week bug-bounty contest from August 18 to September 1, 2025, offering up to $1 million in prizes for breaking out of its AI code sandbox.
- Researchers submitted 1,285 reports; Vercel validated 1 Critical, 7 High, 15 Medium, 49 Low and 19 Informative findings, with triage running until October 1.
- The most serious finding exposed two flaws in the Linux kernel's networking stack that could affect many major cloud providers, not just Vercel.
- No researcher accessed real customer data during the contest.
- Vercel built and plans to release an automated triage tool that sorted through all 1,285 reports with no human reviewer in the loop.
Vercel makes a product called a sandbox: a walled-off computing environment where artificial-intelligence agents can run code without touching anything outside their box. Think of it as a room with no doors. On August 18, Vercel invited the security research community to try to find a way out.
The contest ran for two weeks on HackerOne, a platform where companies pay researchers to find security flaws before criminals do. Vercel put up a $1 million prize pool and asked two groups to attack: independent researchers working blind, with no access to the underlying code, and engineers from Trail of Bits, a specialist security firm, who could see the source code.
What did the researchers actually find?
No one broke out far enough to read a real customer's files. That is the headline result. But researchers found something with reach beyond Vercel: two separate flaws buried in the Linux kernel's networking stack.
The Linux kernel is the core software layer beneath almost every cloud computing service. One flaw leaks small amounts of private memory from the host machine's kernel. The other crashes the host in a predictable, repeatable way. Because cloud providers use this same Linux layer to keep different customers' workloads separate, both bugs have implications well beyond Vercel. We've tracked Linux kernel vulnerabilities closely this year, and our 10 September report on the NetScaler flaw is a reminder of how quickly kernel-level issues draw active exploitation once details go public.
Vercel learned about the flaws roughly two weeks before the Linux kernel maintainers were told. Patches are under private review and formal vulnerability identifiers, called CVEs (Common Vulnerabilities and Exposures, a public catalogue of known security flaws), are pending. Vercel is withholding technical details until those identifiers are published.
Should Vercel customers be concerned?
Not immediately. No contestant accessed real customer data, and the two Linux kernel bugs are moving through the proper disclosure process. Watch for security notices once the CVEs go public.
The Trail of Bits engineers also flagged a structural issue. Vercel's control plane, the software managing the sandbox from outside, was accepting values sent back from code running inside the sandbox. As Vercel put it: every value crossing that boundary is tenant input, and anything crossing it should be derived server-side or signed with a key the guest cannot reach. The engineers' advice was direct: stop trusting the guest.
How did Vercel handle 1,285 reports in two weeks?
It couldn't, by hand. The first fifty reports were reviewed one by one with a human checking every decision. That approach broke under volume. Vercel built an automated agent that reads each report, checks it against contest rules, hunts for duplicates across the full pile, and runs the researcher's proof-of-concept code inside a live sandbox. No human now sits between the agent and its decisions. Vercel plans to release this tool as open-source software, built on a model called Kimi K3.
The volume itself is telling. Our 2 September piece on AI and bug bounties found that AI-assisted researchers are already reshaping submission rates across the industry, and 1,285 reports in fourteen days underlines that point hard.
The honest caveat is one Vercel itself acknowledges: no successful break-in does not prove the sandbox is unbreakable. It means no one broke in during these two weeks. That distinction matters, and it's the thing anyone benchmarking their own sandbox program against this result should keep front of mind.
