Vercel counts 1,285 sandbox reports and a Linux kernel defect

On 14 October 2026, Andy Riancho, principal security engineer, published Findings from the $1 million Vercel Sandbox challenge. Vercel’s account posted the same totals at 23:13 UTC that day: 1,285 reports, $242,000 in bounties paid, one Linux kernel zero-day, and no reports of customer data compromise.

The post says the challenge launched in August and drew 1,285 reports over two weeks. Of those, Vercel counts 877 duplicates, 319 not applicable, 57 valid, and 32 informative. Those four buckets add to 1,285. The 57 valid findings are 1 critical, 5 high, 9 medium, and 42 low. Vercel says it paid $242,000. It also writes that this volume “is only possible because researchers now hunt at AI speed.” That sentence is Vercel’s.

The kernel defect

Vercel says the most important report arrived on day three, from Paulos Yibelo (pwn.ai), a HackerOne researcher working from a standard sandbox with no special access. The defect is in the Linux kernel’s networking stack. Crafted packets sent from inside the microVM enabled three attacks, in Vercel’s account: leak host memory over the network, crash the host, and run code on the host.

The memory leak was demonstrated against Vercel production sandboxes. Vercel says memory from the host, the machine a sandbox shares with other tenants, can show up in packets the guest sends, for as long as the guest keeps sending. The crash and the code execution were demonstrated on the researcher’s own KVM and Firecracker machines matching Vercel Sandbox’s configuration. Vercel says two packets crashed the host, shutting down every sandbox on it, and that the same flaw was used to run commands with full administrator privileges on the host.

Vercel says fixes are under private review and CVEs are pending, and that it is not publishing further detail until the patches are public. It says it is disclosing the bug because the bug was separately disclosed in public. The post says Vercel worked with the researcher, with AWS, and with other industry partners, and that the researcher contacted the kernel maintainers. It also says almost every major cloud provider isolates customer workloads on this same layer of the kernel. It does not name kernel versions, and it does not name other companies’ products.

Vercel says no report showed anyone accessing customer data in Vercel Sandbox, and no report showed anyone reading a customer’s files, secrets, or application data.

The other review

Before the public bounty, Vercel says it ran internal assessments and engaged Trail of Bits. Two Trail of Bits engineers spent four engineer-weeks in the source, with access to the repositories and two enterprise test teams, and delivered 20 findings, each tested and tied to code. Their architectural review, as Vercel reports it, concluded the virtualization boundary is sound: each sandbox runs on its own Firecracker microVM with a dedicated guest kernel, and no guest shares a running kernel with the host or with another tenant. Vercel says it implemented three recommendations from that review: treat every value that crosses out of the guest as tenant input, use one component per policy decision, and assume a future zero-day by keeping host kernels current, disabling nested virtualization, and using Firecracker’s jailer.

The same post describes two further bugs. Marcos Hernanz, a Vercel intern, found a cross-tenant leak in the Linux device-mapper storage layer that let a sandbox read recycled disk blocks from deleted sandboxes. A separate report let a researcher who owned two accounts swap snapshot storage objects, so restoring one snapshot materialized the other account’s filesystem. Vercel says aiming that swap at a stranger required a random 96-bit snapshot key that the platform does not expose through the API, and that there was no demonstrated path for a stranger to target another tenant. The fix, Vercel says, shipped within a week: snapshot objects are bound to the project that created them, and snapshot creation moved to a host-side service.

An earlier tally

A SecurityWeek article by Kevin Townsend, dated 15 September 2026, quotes an interim count it attributes to Vercel: 1 critical, 7 high, 15 medium, 49 low, and 19 informative, with about $325,000 committed, and triage running until 1 October. It dates the program from 18 August to 1 September. Those figures are not the 14 October post. This account uses the 14 October numbers. The September article describes a memory leak and a host crash. It does not describe the host code execution the October post adds, and it does not separate the production demonstration from the researcher’s own machines.

Readers who run Vercel Sandbox have Vercel’s statement that the reports did not show customer data being read, and that the kernel patches are still in private review. The October post does not give a kernel version to check.