Vercel opened a public bug bounty on HackerOne on Tuesday, August 18, offering up to $1 million total to any researcher who can break out of Vercel Sandbox, the Firecracker microVM environment the company runs AI-generated and other untrusted code inside. The boundary being tested is the same one that separates an AI coding agent from the host machine, and from every other tenant’s workload, across Vercel’s platform.
The headline number is not a flat prize. It is a ceiling built from per-report payouts, and the program can close before anyone reaches it. Vercel caps any single report at $50,000, reserved for a bug that lets an attacker read or modify another tenant’s data. Below that ceiling, payouts follow four tiers: Critical findings pay $25,000 to $50,000, High severity $10,000 to $25,000, Medium $5,000 to $10,000, and Low $1,000 to $5,000. Reaching the full $1 million would take dozens of confirmed critical-tier reports, each tied to a distinct root cause rather than a duplicate of an earlier finding.
The scope is narrow by design. Two categories of bugs qualify: breaking out of the microVM onto the underlying host, crossing into a different tenant’s sandbox to read, alter, or run code there, or forcing another tenant’s sandbox to crash, and separately, getting past the firewall that governs outbound network traffic without ever touching the microVM itself, whether that means reaching an unapproved destination, pulling data out, or grabbing credentials the platform is supposed to inject only at the boundary. One class of finding is explicitly excluded: breaking into the Linux container that runs inside the microVM but stopping there, without reaching the guest kernel or the host. Vercel calls that container layer a convenience for developers, not the actual security wall. Static analysis alone will not earn a payout either; researchers have to show a working proof of concept that reproduces the break.
The boundary under test is the one every AI agent platform now leans on. Firecracker microVMs became the default way to run model-generated code because they isolate a guest kernel per workload, but that isolation only holds if the compute side and the network side hold together. Vercel’s blog post disclosed that its own CTO recently pointed an unsafeguarded open-weight model at the sandbox: the model did not break out, but it mapped the machine’s guest kernel, assembled its own virtual machine to test ideas against, and wrote a fuzzing tool. A $1 million pool is Vercel’s own estimate of what that boundary is worth defending, and by extension, a rough proxy for what a real escape could cost the company in exposed tenant data.
Two weeks is a tight runway for this kind of research. Mapping a guest kernel and building a reproduction environment, the work Vercel says its own CTO’s model attempt produced, is the sort of project that specialized virtualization researchers spend weeks or months on, not days. That favors security firms and independent researchers who already study Firecracker or KVM internals over newcomers starting from scratch, and it raises the odds the window closes with the pool largely unspent.
A time-boxed bounty that turns up nothing critical is not proof the sandbox holds. It only proves that this particular group of researchers did not break it in this particular window. Public bounty programs also function as marketing: a well-publicized challenge signals confidence to customers regardless of what researchers find, and Vercel is running this one openly, with HackerOne administering submissions. The more durable signal arrives after the program ends. Vercel says it will keep triaging submissions for a month past the September 1 close, pay out confirmed reports, and publish a writeup of the techniques and fixes that resulted.
Teams running AI agents on any microVM-based sandbox, not only Vercel’s, should treat that eventual writeup as a checklist of failure modes worth testing against their own infrastructure before assuming their own boundary holds.
Vercel detailed the bounty program, its scope, and its bounty tiers in an August 18, 2026 post on the company’s blog.
