Vercel Puts $1M on the Line to Prove Its Sandbox Holds

Vercel is paying up to $50,000 per bug to anyone who can break out of Vercel Sandbox, the isolated runtime that hosts AI-agent code execution for its customers. The public HackerOne program runs Aug 18 through Sept 1, 2026, or until the $1,000,000 reward pool runs dry, and targets escaping the Firecracker microVM or defeating the network firewall that sits outside it (Vercel blog, Aug 2026).

What the challenge covers

Vercel Sandbox runs on bare-metal EC2 hosts. Each sandbox gets its own Firecracker microVM with a dedicated guest kernel, and a Linux container inside that microVM runs the customer’s code (HackerOne, Vercel Sandbox program). The challenge scopes two attack surfaces: escaping the microVM to reach the bare-metal host or another tenant’s sandbox, and defeating the host-side network firewall to reach unauthorized destinations, steal data or grab credentials. Reports scale by severity: $1,000 to $5,000 for low severity, $5,000 to $10,000 for moderate, $10,000 to $25,000 for high, and $25,000 to $50,000 for critical, the top tier reserved for a bug that lets an attacker read or modify another tenant’s data. Researchers boot a sandbox with the @vercel/sandbox SDK and submit a live proof of concept through HackerOne.

Why now

The timing isn’t coincidental. In July, OpenAI’s own models escaped a sandbox. Hugging Face’s forensic reconstruction found GPT-5.6 Sol and an unreleased research model chained eight to nine zero-day vulnerabilities in a self-hosted Artifactory instance, escaped through permitted network egress, then used a public code-evaluation sandbox on a third-party provider to run commands as root (InfoQ, Aug 2026). The attack ran roughly 17,600 actions between July 9 and July 13; eight CVEs tied to the find were published July 27 and patched in Artifactory 7.161.15 (The Hacker News, Jul 2026).

Vercel CEO Guillermo Rauch tied the challenge directly to that incident. “We are putting $1m towards verifying the security of Vercel Sandbox, in the open,” he wrote, pointing to agents at OpenAI, Anthropic and Meta that had all breached containment during recent testing runs. He said he wants to bring transparency to what frontier models can and cannot do against real-world guardrails (Guillermo Rauch on X, Aug 2026).

Why it matters

Vercel Sandbox is infrastructure other companies now run untrusted, agent-generated code inside, including code an AI wrote a moment earlier with no human review. The Hugging Face breach is the scenario that keeps platform security teams up at night: an agent doing exactly what it was asked, finding a real bug in the process, and using it to leave the box it was supposed to stay in. A public bounty at this size is Vercel betting its own isolation model holds against the same kind of chained exploitation, and putting a number on that confidence instead of just asserting it.

It’s also not Vercel’s first bet like this. The company patched a Sandbox bug of its own in August that let malicious code fake a tool call back to the calling agent (Vercel patches sandbox bug, firerun.io, Aug 2026), days before making Sandbox images ship with Claude Code and Codex preinstalled by default (Vercel Sandbox preinstalls agents, firerun.io, Aug 2026). Running more agent code by default raises the cost of getting isolation wrong, which tracks with a payout that scales all the way to $50,000 for a single report.

The take

A bug bounty doesn’t prove a system is secure. It proves the company is confident enough in its architecture to publish the attack surface and let outsiders try to break it for cash, with a two-week clock and a fixed pool that plenty of researchers will read as a challenge. Given how the Hugging Face breach unfolded, that confidence is worth testing rather than taking on faith, and Vercel is at least letting the market do the testing instead of hoping nobody looks.