Vercel Sandbox Vulnerability Allows AI Agents to Leak Data
Researchers have identified a network filtering flaw in Vercel Sandbox that could enable rogue AI agents to bypass isolation and exfiltrate sensitive information.
Cybersecurity researchers have uncovered a critical vulnerability within Vercel Sandbox, a widely adopted tool for running code in isolated environments, which could allow rogue AI agents to leak sensitive data. The flaw, detailed in research by AI security startup AIR, exploits a network filtering weakness that enables AI agents to circumvent restrictions designed to keep them contained.
Developers commonly employ sandboxes like Vercel Sandbox to prevent AI agents from accessing unauthorized systems or transmitting confidential information. These environments typically enforce network allowlists, permitting communication only with approved destinations and blocking connections to untrusted servers. However, AIR's findings indicate that these safeguards can be bypassed.
The vulnerability lies in how servers handle digital certificates. AIR researchers demonstrated that a specially crafted certificate could be sent to an approved server. This certificate could then trigger a request to an attacker-controlled server, effectively acting as an "unwitting courier" for stolen data. Crucially, the sandbox itself never directly communicates with the malicious destination, making the exfiltration difficult to detect from its perspective.
"This vulnerability shows that enterprises can have Hugging Face style mini incidents with their own agents," said Niv Hoffman, AIR co-founder and CTO. "The new contribution our research makes is showing that even in the standard hardened sandbox of today, there are still flaws that will make an agent going rogue manage to escape the sandbox and do things in the wild."
AIR has notified Vercel about the vulnerability. The company acknowledged the issue and stated that developing a patch will require time, as the exact remediation steps are not immediately clear. Vercel has not yet released a public statement or a timeline for a fix. As of the research publication, AIR has not observed any exploitation of this vulnerability in the wild, though they cannot definitively rule out past incidents given the potentially longstanding nature of the flaw.
This discovery highlights a significant challenge in securing AI development environments. The ability for an agent to leverage an intermediary, approved server to communicate with an unauthorized destination presents a novel and difficult-to-patch escape vector. The research underscores the need for continuous vigilance and innovative security measures as AI agents become more integrated into enterprise workflows.
"It's a very hard leak to patch," Hoffman added. "This sandbox never communicated directly with the attack server… so from the sandbox perspective, everything looked fine." The implications extend beyond Vercel Sandbox, suggesting that similar vulnerabilities might exist in other sandboxing technologies if certificate validation and network filtering are not meticulously implemented and monitored.
Nic Adams, co-founder and CEO of cyberkinetics company 0rcus, commented on the research, noting that an approved server can become an "unwitting courier for stolen credentials." He emphasized that "Security has to account for what happens after the first connection," a principle that becomes increasingly vital in complex, interconnected AI systems.