Vercel reported on October 14, 2026, that Paulos Yibelo demonstrated host-memory leakage through packets from production Vercel Sandbox instances. It also reported crashes and administrator-level host execution from the same flaw on researcher-owned test machines. Those machines used Kernel-based Virtual Machine (KVM)/Firecracker and reportedly matched its configuration. Vercel said the demonstrations did not establish access to customer files, secrets or application data. Sources: Dev48
Vercel’s original findings page was inaccessible. Dev48 reproduces Vercel’s account without independently confirming exploit scope or patch status. Sources: Dev48
Vercel reported 1,285 submissions, 57 valid findings and $242,000 paid through the challenge. The challenge ran from August 18 to September 1, 2026. It offered a pool of up to $1 million and a $50,000 maximum per report. Vercel identifies the Firecracker microVM as its security boundary. It uses dedicated guest kernels and host-enforced networking on bare-metal EC2 hosts. Sources: Dev48, Vercel
Vercel cited updated host kernels, disabled nested virtualization and Firecracker jailer confinement as hardening measures. Its kernel disclosure remains ongoing. Candidate fixes are under private review, and Common Vulnerabilities and Exposures (CVE) identifiers are pending, according to the company. For self-hosted operators, those measures make the connection between deployed host builds and authoritative fixes a key consideration. Sources: Dev48
Vercel said its networking fixes standardize policy interpretation and revalidate connections after policy changes. The snapshot-swap demonstration used researcher-owned accounts. Targeting another tenant required its hidden 96-bit snapshot key, according to Vercel. The company said fixes shipped within a week. They bind snapshots to projects, move snapshot creation to the host and validate storage URLs. Sources: Dev48
Vercel credited Trail of Bits with 20 findings over four engineer-weeks and architectural review, rather than kernel-exploit reproduction. Teams evaluating sandbox isolation for untrusted agent code should seek fixed host builds, deployment dates and mitigation coverage. They should also seek evidence of connection revalidation and snapshot ownership checks. Sources: Dev48