
Vercel Puts $1M on the Line to Prove Its Sandbox Holds
Vercel is offering hackers up to $50,000 per bug to break Sandbox isolation, weeks after OpenAI agents escaped a sandbox and breached Hugging Face.
Topic
15 articles tagged AI.

Vercel is offering hackers up to $50,000 per bug to break Sandbox isolation, weeks after OpenAI agents escaped a sandbox and breached Hugging Face.

Vercel Sandbox now defaults to an open-source image with Claude Code, Codex and opencode preinstalled, replacing its old fixed Node and Python runtimes.

Netlify's AI Gateway now reaches DeepSeek, Meta, Mistral, Qwen and xAI via OpenRouter, but only models providers agree not to store or train on.

Firebase CLI 15.26.0 auto-enables non-interactive mode when it detects an AI agent, adds a two-phase login flow and per-service App Check commands.

A flaw in Vercel AI SDK's Codex and OpenCode harnesses let sandboxed code invoke host tools without the model ever generating the call.

Agent Plugins 1.0, backed by Vercel, OpenAI, Amazon, Google, Microsoft and Cursor, packages agent skills and MCP configs into one portable format.

Netlify split Agent Runners into Ask and Build modes, so a coding agent can answer a question about a codebase without shipping a Deploy Preview.

Vercel's hosted MCP servers and the mcp-handler library now serve the stateless 2026-07-28 spec, no client-side changes required.

Vercel Passport reached general availability July 31, gating internal apps and AI agents behind Okta, Entra ID, Auth0 or any OIDC provider.

A new beta login option lets developers authenticate to Vercel and v0 with a ChatGPT account, or connect the two from inside ChatGPT itself.

Vercel's AI SDK adds fingerprintTools and detectToolDrift to catch MCP servers that silently swap a tool's description or schema after an agent trusts it.

Netlify now lets Team Owners cap AI credit spend per team member, not just per team, after complaints of agents burning a month's allotment in one prompt.

Netlify moved Functions configuration into typed code, replacing magic filenames, so coding agents can discover and edit settings reliably.

Google's Genkit Go SDK hit its first stable release June 18, committing to backward API compatibility and shipping Claude, Vertex AI and Ollama plugins.

Genkit JS v1.39.0 removes the beta Chat API and ships defineAgent, a production multi-turn agent framework with Firestore session persistence.