Vercel Launches Hacker Challenge Offering $1 Million for Sandbox Escapes

When AI agents execute untrusted code, Firecracker microVM is the standard isolation method, but the security model can collapse if network boundaries are missing. Recently, Vercel's CTO tested open-weight models within the sandbox; while the models did not escape, they explored attack vectors such as mapping the guest kernel and writing fuzzers.

To proactively verify security boundaries without relying on attacker timelines, Vercel is launching a two-week public program via HackerOne. The period runs from August 18 to September 1, 2026, with a total prize pool of $1 million.

Compensation is based on single-root chaos, with up to $50,000 per vulnerability that allows reading or modifying data from other tenants. Key attack targets include:

• Compute boundary: Escaping from the microVM to the EC2 host or accessing sandboxes of other tenants
• Network boundary: Bypassing the sandbox firewall to exfiltrate data to unauthorized destinations

Vercel sandboxes run on bare-metal EC2 hosts, with each instance consisting of a microVM with a dedicated guest kernel and a Linux container inside it. Network controls are enforced on the host outside the microVM, designed to prevent modification or deactivation by internal code.