- AIR researchers say Vercel Sandbox's network filtering can be bypassed with a crafted certificate, letting a rogue AI agent send data out through an approved server.
- The sandbox never contacts the attacker directly, so allowlist checks look clean. AIR found no exploitation in the wild but cannot rule it out, and Vercel has no patch yet.
- Leaders should list which agents run in sandboxes, what credentials those agents hold, and whether anything watches traffic past the first approved connection.
A guard who checks only the first door will miss what happens behind it. That is the lesson in new research on Vercel Sandbox, a tool developers use to run code, including AI agents, in an isolated space. The security startup AIR says the isolation can be bypassed. The Record reported the findings.
What the researchers found
AIR found a flaw in the network filtering of Vercel Sandbox. Sandboxes exist so an agent cannot reach unauthorized systems or send out sensitive information. One common control is an allowlist, which limits the agent to a short list of approved destinations.
AIR says a rogue agent can get around that list. The method relies on how servers handle digital certificates, the files a server presents to prove its identity.
In the researchers' demonstration, a specially built certificate was sent to an approved server. That certificate caused the server to make a request to a server the attacker controls. The data left the sandbox that way.
Why the filter saw nothing wrong
The allowlist checks where the sandbox sends traffic. In this case the sandbox only talked to an approved server, so the check passed.
The second hop happened elsewhere. The approved server made the call to the attacker. AIR co-founder and CTO Niv Hoffman put it this way: the sandbox never communicated directly with the attack server, so "from the sandbox perspective, everything looked fine."
Think of a mailroom that checks the address on every envelope but not what the recipient does after opening one. The control works as designed. It is simply watching the wrong step.
What is still unknown
Hoffman said AIR told Vercel about the flaw. He said Vercel needs time to find a patch because it is unclear how the fix will be done. He called it "a very hard leak to patch."
Vercel did not immediately respond to The Record's request for comment. The Record's report does not include a Vercel statement.
AIR has found no evidence of exploitation in the wild. Hoffman said the team cannot rule it out, and he said the flaw appeared to be longstanding.
The report also gives no CVE identifier and no list of affected versions. Readers should treat the details as AIR's findings, not as a confirmed vendor advisory.
The idea behind the flaw
Many teams treat a sandbox as a promise that an agent cannot do harm. This research shows the promise rests on assumptions about what an approved server will do. Nic Adams, co-founder and CEO of 0rcus, told The Record that an approved server can become an "unwitting courier for stolen credentials." He added that security "has to account for what happens after the first connection."
Hoffman warned that enterprises can have "mini incidents" with their own agents, in the style of a Hugging Face incident. The Record's report does not describe that incident.
The people who carry this risk are not the researchers. They are the engineers who gave an agent credentials on the assumption that the walls would hold, and the executives who approved that setup.
Questions to put to your team
First, ask which AI agents run in sandboxes today, and which of those use Vercel Sandbox. Second, ask what secrets or credentials each agent can reach inside the sandbox. If an escape happened, those are what would leave.
Third, ask whether an allowlist is the only control on outbound traffic. Fourth, ask whether anyone monitors what approved servers do next, since the leak in this research happened one step past the checked connection.
Finally, ask Vercel for a patch timeline and any interim guidance. The company has not yet said how it will fix the flaw.
A wall that checks only the first connection can still leak. Plan for what happens after it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
