// AI threat desk · 14 Oct 2026
Home/AGENT · Agent Security
Agent SecurityCriticalRCECVSS 9.1

Vercel Sandbox flaw could let agents bypass allowlists and leak keys

A vulnerability in Vercel Sandbox could let a rogue agent bypass the domain allowlist and leak keys to an attacker-controlled server.

· 2 min read
AI-generated image of security analysts examining a sandboxed development environment and redacted credentials on monitors.
AI-generated image, not a photo of the event.
Key takeaways
  • A rogue agent can bypass Vercel Sandbox’s domain allowlist and leak keys to an attacker-controlled server.
  • The technique places sensitive data in a crafted client certificate’s Authority Information Access URL, prompting an allowed server to make the external request.

AIR said it found a vulnerability in Vercel Sandbox that lets a rogue agent bypass the product’s domain allowlist and leak keys to an attacker-controlled server.

AIR said its testing received an exfiltrated key on its own server, which was not on the trusted-domains list.

Vercel Sandbox runs workloads inside Firecracker microVMs and can restrict outbound network access.

On this page

mTLS and AIA let an allowed server relay the data

AIR said the research focused on an interaction between mutual TLS and the Authority Information Access certificate extension. An attacker controlling a compromised agent can place sensitive data in the URL inside a crafted client certificate’s AIA extension.

The sandbox blocks the agent’s direct connection to the attacker’s server, AIR said. The data leaves when a trusted server makes the external request on the agent’s behalf.

AIR said the technique used a standard TLS feature and did not exploit a vulnerability on the server. “No vulnerability was exploited on the server,” it said.

AIR said sandboxing cannot guarantee that data stays inside

AIR said sandboxing can block connections it can see but cannot guarantee that data will not leave. It described sandboxing as a risk-reduction measure rather than a security boundary on its own.

Because external communication cannot be fully blocked, AIR said the way to protect data is to filter communication and prevent exposure to malicious content.

AIR said Vercel classified the finding as out of scope and did not accept the report.

AIR said it had not found evidence that the vulnerability was exploited in the wild, but could not rule out whether exploitation had occurred.

FAQ

What happened to Vercel Sandbox?

AIR found that a rogue agent can bypass Vercel Sandbox’s domain allowlist and leak keys to an attacker-controlled server.

How does the Vercel Sandbox vulnerability work?

The technique places sensitive data in a crafted client certificate’s AIA URL, causing an allowed server to request an attacker-controlled URL on the agent’s behalf.

Was the Vercel Sandbox flaw exploited in the wild?

AIR said it had not found evidence of exploitation in the wild, but could not rule out whether exploitation had occurred.

Was the Vercel Sandbox vulnerability patched?

AIR said Vercel classified its finding as out of scope and did not accept the report.

Sources

  1. VerCellBreak: How we escaped Vercel's hardened sandbox, AIRPrimary
  2. Cellbreak: Grist’s Pyodide Sandbox Escape and the Data-at-Risk Blast Radius, Cyera Research LabsPrimary
  3. Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says, The Record
  4. Pyodide Sandbox Escape Enables Remote Code Execution in Grist-Core, Grist-Core security team
How we checked this story
ClaimSourceStatus
AIR found that VerCellBreak lets a rogue agent bypass Vercel Sandbox’s domain allowlist and leak keys to an attacker-controlled server.AIRConfirmed
AIR said Vercel Sandbox uses Firecracker microVMs and outbound network restrictions to limit where workloads can send data.AIRConfirmed
AIR said its research found that Vercel Sandbox’s network restrictions could be bypassed to receive an exfiltrated key on an untrusted server.AIRConfirmed
AIR said the finding involved an interaction between mutual TLS and the Authority Information Access certificate extension.AIRConfirmed
AIR said an attacker can place sensitive data in a crafted client certificate’s AIA URL, causing an allowed server to request an attacker-controlled URL.AIRConfirmed
AIR said the sandbox blocks an agent’s direct connection to an attacker server, but an allowed server can make the external request on the agent’s behalf.AIRConfirmed
AIR said its technique used a standard TLS feature and did not exploit a vulnerability on the server.AIRConfirmed
AIR said sandboxing cannot guarantee that data will not leave because it can block only connections it can see.AIRConfirmed
AIR said defenders should filter communication and prevent exposure to malicious content because external communication cannot be fully blocked.AIRConfirmed
The Record reported that AIR found a network filtering flaw in Vercel Sandbox that could let agents transmit data outside approved networks.AIR, via The RecordAttributed
AIR co-founder Niv Hoffman said the flaw shows hardened sandboxes can still let a rogue agent escape and act in the wild.Niv Hoffman, via The RecordAttributed
The Record reported that AIR had not found evidence of exploitation in the wild but could not rule it out.AIR, via The RecordAttributed
Nic Adams said an approved server can become an unwitting courier for stolen credentials.Nic Adams, via The RecordAttributed
cyera.com published its report on Sep 9, 2026.cyera.comConfirmed

Could not verify

  • Whether the vulnerability has been exploited in the wild is not established.
  • How many Vercel Sandbox deployments or agents are affected is not established.
  • Whether Vercel accepted or rejected a formal vulnerability report is disputed by the sources.
agentsdata leak
See all in Agent Security →
Explore with AI
ChatGPT
Claude
Perplexity
Grok