Vercel launches $1M Sandbox escape security challenge

• Vercel opened a two-week HackerOne challenge for real breaks of its Sandbox isolation, targeting Firecracker microVM escapes and host-side network-boundary bypasses, as the launch announcement describes.
• The pool totals up to $1 million, with individual reports eligible for as much as $50,000 when the demonstrated impact reaches another tenant's data, according to the launch announcement.
• The scope covers both compute isolation and egress controls, which the technical scope frames as the two prerequisites for containing an agent running hostile code.
• Researchers may use any model to hunt for an escape, and the model-testing announcement says Vercel intends to publish what the exercise finds about practical guardrail exploitability.

Vercel says an open-weight model with safeguards removed already mapped the guest kernel, built a VM to reproduce its ideas, and wrote a fuzzer, but did not escape, in the challenge post. Its earlier network-boundary design note distinguishes containing a process from stopping that process from reaching services, credentials, or the public internet.

The published scope asks researchers to break either compute isolation or host-side network policy. the technical scope identifies the same two targets.

• Compute boundary: escape the Firecracker microVM to its EC2 host, reach another tenant's sandbox to read, modify, or execute code, or crash another tenant's sandbox, under the program rules.
• Network boundary: reach a destination the operator did not authorize, exfiltrate data, or retrieve credentials brokered at the boundary, as defined in the challenge scope.

The challenge post gives Sandbox a three-level stack:

1. A bare-metal EC2 host.
2. A dedicated Firecracker microVM and guest kernel for each sandbox.
3. A Linux container inside that microVM, where operator code runs.

Vercel treats the microVM, rather than the container, as the security boundary. Its stated threat model grants the code root inside the container and kernel-level access inside the guest, while a container namespace escape that reaches only the guest OS is excluded from bounty scope.

The firewall sits on the host, outside the microVM, so code in the sandbox cannot disable it, according to the technical architecture. the launch announcement makes bypassing that layer a co-equal challenge target with VM escape.

The design intercepts:

• outbound TCP connections;
• DNS requests;
• domain and CIDR policy checks for each connection;
• credential injection at the boundary, keeping those credentials out of the microVM.

Vercel's Sandbox documentation describes the product as an isolated, ephemeral Linux VM environment for arbitrary code, including agent and code-generation workloads.

The HackerOne program runs from August 18 through September 1, 2026, unless the $1 million pool is depleted first. Vercel's official bounty table sets individual awards at:

• Critical: $25,000 to $50,000
• High: $10,000 to $25,000
• Medium: $5,000 to $10,000
• Low: $1,000 to $5,000

Each payout is assigned to a single root cause and based on the maximum demonstrated impact. Static-analysis findings alone do not qualify: the report must reproduce the boundary break with a live proof of concept, typically using the @vercel/sandbox SDK.

Researchers can use any model in the challenge, the model-testing announcement says. Vercel says confirmed escapes will be patched and shared, with the program meant to produce evidence about what frontier models can actually do against a live sandbox boundary.

Vercel says it will triage reports from the program's opening through one month after it closes, paying confirmed bounties and crediting researchers whose reports hold up. The challenge post says the company will publish a follow-up covering discovered techniques and shipped fixes, then retain those techniques as permanent additions to the Sandbox boundary.