Skip to content
View original post on X: Guillermo RauchX· 30/100AI score30/100

Vercel says a researcher escaped its Linux sandbox in a $1M challenge

AISummary

Guillermo Rauch says a white-hat researcher using AI agents broke through the Linux virtualization boundary of Vercel Sandbox during a $1M escape challenge. The challenge drew 1,285 reports and paid $242,000 in bounties, along with one Linux kernel zero day. Vercel reports finding no evidence of customer data compromise and says it is working with industry partners.

Post on XView on X
Guillermo RauchVerified on X
@rauchg

This is one of the most exhilarating times in technology, and this challenge was yet another jaw-dropping moment.

When the details of OpenAI’s agent escape and Hugging Face hack started to emerge, it became clear that agent containment would be one of the most important priorities for any AI infra company.

There are two classes of escapes: ① "escape the network" and ② “escape the matrix” 😁, as in, break the spell of virtualization. OpenAI was the former, where an agent not supposed to have internet access… gained it by hacking another system. Genuinely astonishing and worrisome.

Through this challenge, however, we discovered something even more groundbreaking. A talented white-hat researcher, armed with a swarm of AI agents, expertise and perseverance, "pierced through" the Linux virtualization boundary that nearly every cloud sandbox provider in the world banks on today.

I'm very thankful we got the report, were able to quickly move to protect our customers, found no evidence of customer data compromise, and collaborated with many industry partners to protect the wider internet.

Our confidence and conviction in Vercel Sandbox are even greater now, after some of the smartest, most motivated researchers in the world, and their agents, gave it their best shot.

Vercel@vercel
We offered $1M to escape Vercel Sandbox. • 1,285 reports • $242,000 in bounties paid out • One Linux kernel zero day discovered • No reports of customer data compromise https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
View quoted post on X

Source: Guillermo Rauch · x.comPublished · added here