Vercel's $1m sandbox escape challenge turned up two unfixed Linux kernel networking defects

The two defects sit below the microVM boundary. Both are in Linux kernel networking code, and neither is in Vercel's own software: one leaks memory from the host kernel into guest reach, the other crashes the host deterministically ^[6]. A host that goes down from inside a guest takes its co-resident workloads with it ^[22]. Vercel said it is keeping details out of its writeup until the fixes are public, and it did not publish CVE identifiers or affected kernel versions ^[9].

1,285 reports across fourteen days is about 92 a day ^[18]. Validation has cleared 91 of them, roughly 7 percent of the intake, with the rest still moving ^[19]. The $325,000 committed is about a third of the pot ^[20], which works out at roughly $3,570 per validated report ^[21].

The white-box track aimed at Vercel's own code. Two Trail of Bits engineers filed 20 findings, agreed with Vercel's choice of virtualization, and made three structural recommendations, one of them "stop trusting the guest" ^[10]. Vercel described the flaw in its own architecture this way: "Our control plane accepted values returned by software running inside the microVM. Every one of those values is tenant input. Anything that crosses the boundary should be derived server-side or signed with a key the guest cannot reach" ^[11]. The orchestration layer accepted tenant input as trusted, a design defect black-box hunters rarely reach.

Triage broke before the sandbox did. Vercel started with one chat per report and a human reviewing every decision ^[12]. "That MVP was the right call for the first fifty reports, and the wrong one for the next thousand," the company said ^[13]. The replacement is an agent built on Vercel's Eve framework that reads each report, checks it against program policy, hunts duplicates across a thousand filings, pulls source trees, and runs the researcher's proof of concept inside a real Vercel Sandbox ^[14]. Vercel pulled the human out of the decision loop to cut latency ^[16], and plans to open source the agent, which runs on Kimi K3 ^[15].

For anyone else running Firecracker-style isolation, the useful part of this exercise is the location of the bugs. The escape attempts left the hypervisor standing. They found kernel code that many major cloud providers depend on for the same tenant separation ^[7], and Vercel had that knowledge two weeks before the maintainers did ^[8].