SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Crafted certificate lets an agent in Vercel Sandbox leak data past its network allowlist, AIR says
AI security startup AIR says a certificate flaw in Vercel Sandbox lets an agent send data to an attacker's server via an approved host. Vercel told AIR it needs time to find a fix, co-founder Niv Hoffman said, so operators have nothing to apply yet.
The Watch · Security desk
In AIR's demo, a crafted certificate sent to an approved server triggers a request to an attacker's server. Nic Adams says the approved server can courier stolen credentials. The sandbox never contacts the attack server, so everything looked fine. Vercel needs time to find a patch.
- capability Attacker-controlled server Gets a request triggered by a crafted certificate sent to an approved server, in AIR's demo, claim 3
- exposure Approved server Can become an "unwitting courier for stolen credentials," says Nic Adams, claim 11
- constraint Vercel Sandbox Never talks to the attack server directly, so "everything looked fine," Hoffman says, claim 6
- decision Vercel Told Hoffman's team it needs time to find a patch; how is "unclear for them right now", claim 12
| Who | How | Kind | Claim |
|---|---|---|---|
| Attacker-controlled server | Gets a request triggered by a crafted certificate sent to an approved server, in AIR's demo | capability | 3 |
| Approved server | Can become an "unwitting courier for stolen credentials," says Nic Adams | exposure | 11 |
| Vercel Sandbox | Never talks to the attack server directly, so "everything looked fine," Hoffman says | constraint | 6 |
| Vercel | Told Hoffman's team it needs time to find a patch; how is "unclear for them right now" | decision | 12 |
What happened
- AIR announced the finding on Monday; The Record describes Vercel Sandbox as a widely used tool for running code in isolated environments.
- In AIR's demonstration, a crafted certificate sent to an approved server triggers a request to an attacker-controlled server, so the sandbox never contacts the blocked destination directly.
- AIR has found no evidence of exploitation in the wild but cannot rule it out, and Hoffman said the flaw appears to be longstanding.
- Vercel did not immediately respond to a request for comment.
Why it matters
- exposure Credentials or data an agent can read inside a Vercel Sandbox sit behind an allowlist that AIR says a crafted certificate bypasses.
- decision With no patch date from Vercel, teams must decide now whether agents in that sandbox keep access to credentials.
- constraint The sandbox saw only an approved connection, and the flaw looks old, so clean sandbox logs cannot clear past activity.
An allowlist checks where the sandbox connects [4]. In AIR's demonstration that check passes, because the only server involved from the sandbox's side is an approved one [3]. Hoffman said "from the sandbox perspective, everything looked fine." [6] The report's own summary is short: "A crafted certificate is all it takes." [8]
Patching is the open problem. Hoffman said, "It's a very hard leak to patch." [5] He said his team contacted Vercel, and that the company told them it needs time because "it's unclear for them right now how it's going to be done." [12] The Record's account does not cite a CVE identifier or a date for a fix.
Everything in the account comes from AIR, a security startup that published its own research [9], plus Hoffman's interview. Vercel's side is limited to what Hoffman relayed [12]. Hoffman went further than the single flaw. He said "even in the standard hardened sandbox of today, there are still flaws that will make an agent going rogue manage to escape the sandbox and do things in the wild." [10] That is a researcher's claim about sandboxes in general, and the article supports it with one case.
On exploitability, the scenario starts with an agent that is already acting against its operator [1]. The article does not say how an agent would get there. The research covers the way out. In our view the flaw matters where an agent holds credentials or sensitive data, and matters little where the sandbox holds nothing worth taking. Where an agent does hold them, the allowlist is the control AIR says is bypassed [1].
Nic Adams, co-founder and CEO of 0rcus, a cyberkinetics company, told The Record the research shows an approved server can become an "unwitting courier for stolen credentials." He added: "Security has to account for what happens after the first connection." [11]
What to watch
- Whether Vercel publishes a fix or advisory, and whether a CVE identifier is assigned.
- Whether AIR or anyone else reports exploitation in the wild, which AIR says it cannot rule out.
- Whether Vercel comments publicly on AIR's account of its response.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Research published by AI security startup AIR found a network filtering flaw in Vercel Sandbox that could allow agents to exploit certificate validation processes to transmit data outside approved networks, bypassing restrictions designed to keep rogue agents isolated.
- [2]
Researchers said on Monday that they had discovered the vulnerability in a widely used AI development sandbox, Vercel Sandbox, a tool used to run code in isolated environments.
- [3]
In AIR's demonstrated scenario, a specific certificate was designed that could be sent to an approved server and then trigger a request to an attacker-controlled server, so data could be transmitted without the sandbox ever directly communicating with the unauthorized destination.
- [4]
Developers use sandboxes to keep AI agents from accessing unauthorized systems or transmitting sensitive information; network allowlists restrict communication to approved destinations and keep agents from connecting to untrusted servers.
- [5]
Niv Hoffman, AIR co-founder and CTO, said: "It's a very hard leak to patch."
- [6]
Hoffman said the sandbox never communicated directly with the attack server, "so from the sandbox perspective, everything looked fine."
- [7]
AIR has not found evidence of any exploitation of the vulnerability in the wild but cannot rule out that there has been one, Hoffman said; the vulnerability appeared to be longstanding.
- [8]
The AIR report said: "A crafted certificate is all it takes."
- [9]
AIR is an AI security startup that published the research.
- [10]
Hoffman said the research shows that "even in the standard hardened sandbox of today, there are still flaws that will make an agent going rogue manage to escape the sandbox and do things in the wild."
- [11]
Nic Adams, co-founder and CEO of 0rcus, a cyberkinetics company, said the research shows an approved server can become an "unwitting courier for stolen credentials" and that "Security has to account for what happens after the first connection."
- [12]
Hoffman said his team contacted Vercel about the vulnerability and the company said it needs time to find a patch because "it's unclear for them right now how it's going to be done."
- [13]
Vercel did not immediately respond to a request for comment.
Sources
1 independent publisher whose own reporting we read for this story.
- therecord.mediaSandbox vulnerability gives rogue AI agents a path to escape and leak data, research says
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.