$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
Vercel’s two-week bug bounty program, utilizing a $1 million reward, uncovered two critical vulnerabilities within the Linux kernel’s networking stack. Despite receiving 1,285 reports, no attackers were able to access customer data, and the program significantly improved Vercel’s sandbox security. The program also highlighted the growing need for AI-powered security solutions to keep pace with increasingly sophisticated attacks, and Vercel plans to open-source its agentic triaging solution.
Vercel recently concluded a two-week bug bounty program, offering a $1 million reward, to test the security of its microVM environment, designed for untrusted AI agent code. The program, which ran from August 18th to September 1st, involved black box testing by HackerOne hackers and white box testing by Trail of Bits engineers.
Despite receiving 1,285 reports, Vercel confirmed that none of the submitted findings resulted in any attackers gaining access to customer data. The program’s success demonstrates the effectiveness of Vercel’s sandbox and the growing importance of robust isolation techniques in cloud environments.
The most significant discoveries involved two independent vulnerabilities within the Linux kernel’s networking stack. One leaked memory from the host kernel, while the other caused a host crash, deterministically. These flaws are particularly concerning because many major cloud providers utilize the same layer of the Linux kernel for workload isolation. The bug bounty program allowed Vercel to learn about these vulnerabilities two weeks before the kernel maintainers would have.
Trail of Bits engineers, through white box testing, identified 20 additional findings, but Vercel valued their architectural advice, specifically recommending to ‘stop trusting the guest’. This involved ensuring that all values received from software running inside the microVM were derived server-side or signed with a key the guest could not reach.
The sheer volume of reports presented a significant challenge, prompting Vercel to develop an agentic triaging solution. This system automatically reads each report, checks it against program policy, hunts for duplicates across a thousand filings, pulls source trees, and runs the researcher’s proof of concept inside a real Vercel Sandbox. Vercel plans to open-source this agent running on Kimi K3.
Interestingly, Vercel concluded that AI defense is necessary to counter the speed of AI attacks, and they are removing the human from the loop in their security process. This represents a significant shift in security operations, acknowledging that human review can introduce latency that may become unacceptable as attacks become more sophisticated.
Ultimately, Vercel’s bug bounty program was a success, significantly improving its sandbox security and providing valuable insights for the industry. The program’s findings will be integrated into Vercel’s defenses, protecting all workloads running on its platform. However, it’s important to note that the absence of identified vulnerabilities doesn’t guarantee the absence of vulnerabilities – a negative test result doesn’t negate the possibility of hidden weaknesses.