Vercel conducted a focused two-week bug bounty challenge with a $1 million reward to test the security of its Firecracker-based microVM sandbox designed to isolate untrusted AI-agent code. The program received 1,285 vulnerability reports, including one critical, seven high, and fifteen medium severity findings. The most significant discoveries were two independent vulnerabilities in the Linux kernel networking stack that could leak host kernel memory or cause deterministic host crashes. These kernel flaws affect many cloud providers that rely on Linux kernel isolation layers. Vercel learned of these issues two weeks before kernel maintainers and is coordinating private fixes with CVEs pending. The challenge also highlighted the need for AI-assisted automated triage to manage large volumes of vulnerability reports efficiently. Vercel improved its sandbox security posture based on the findings, with no evidence of customer data compromise.

The vulnerabilities discovered impact the Linux kernel networking stack used in microVM sandbox environments, potentially allowing memory leaks or host crashes. Since many cloud providers use similar Linux kernel isolation techniques, these flaws have wide-reaching implications for cloud workload isolation security. However, during the challenge, no reports demonstrated access to customer data, indicating the sandbox effectively protected sensitive information. The findings enable Vercel and the Linux kernel maintainers to improve security before public disclosure. The high volume of reports also underscores the increasing speed and scale of vulnerability discovery driven by AI-assisted researchers.

Fixes for the Linux kernel vulnerabilities are currently under private review with CVEs pending. Vercel and kernel maintainers are coordinating to release official patches. Until public patches are available, users should monitor vendor advisories for updates. Vercel has already improved its sandbox security based on the findings. The vendor also recommends architectural best practices such as not trusting guest inputs crossing the microVM boundary and deriving sensitive values server-side or signing them with keys inaccessible to guests. Automated AI-assisted triage tools can help manage large volumes of vulnerability reports efficiently. Patch status is not yet confirmed publicly — check vendor advisories for current remediation guidance.