Vercel Sandbox flaw lets rogue AI agents bypass domain allowlists to exfiltrate data
Security firm AIR Security has disclosed a flaw it calls VerCellBreak in Vercel Sandbox, the isolated code-execution environment that runs AI agents in Firecracker microVMs and uses a domain allowlist to restrict which external servers the sandbox can reach. According to the researchers, an attacker who controls an AI agent inside the sandbox and can access sensitive data could use a crafted mutual-TLS client certificate whose Authority Information Access (AIA) field points to an attacker-controlled server; when the agent connects to an allowlisted server that validates the certificate and fetches that URL, the data can leave, and because the request is made by a server outside the sandbox, Firecracker isolation does not need to be broken. AIR says it reported the issue to Vercel, which per AIR co-founder and CTO Niv Hoffman still needs time to work out a fix, and that it has found no evidence of exploitation in the wild; the company also advises enterprises to control what API keys and other sensitive data agents can reach.
The bypass shows that a domain allowlist alone may not contain agents running in sandboxes, so teams should also limit the credentials and sensitive data those agents can access.