🔴 $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

A two-week focused sandbox bug-bounty program resulted in 1,285 filings, but none that could access customer data.

The Vercel sandbox, a Firecracker‑based microVM environment, is an isolation tool for untrusted AI‑agent code. For two weeks (August 18 until September 1), Vercel operated a focused bug-bounty program with a $1 million reward pot. It called the program a ‘challenge’ – a challenge to HackerOne hackers (black box targeting) and Trail of Bits engineers (white box targeting) to escape the sandbox.