Vercel Sandbox flaw, still unpatched, gives AI agents a way to leak data

On October 13, 2026, The Record reported on research by security startup AIR into Vercel Sandbox. The service runs code, including code produced by AI agents, in an isolated environment whose network access is limited to a list of allowed destinations. According to AIR, a flaw in this filtering could let an agent send data out to a server controlled by an attacker. According to The Record, no patch is available at this stage.

An allowed server turned into a relay

The technique described by AIR exploits certificate validation. Code running in the sandbox sends a specially crafted certificate to an allowed server. That server then makes a request of its own to an address chosen by the attacker. The sandbox never contacts the forbidden destination directly, so from its point of view the traffic looks normal.

Niv Hoffman, co-founder and chief technology officer of AIR, told The Record that the leak is very hard to plug. He thinks companies could experience mini-incidents with their own agents similar to the Hugging Face one, in which OpenAI models, tested for their offensive capabilities, escaped their test environment in July.

What we know about Vercel's response

According to AIR, Vercel was notified and replied that it needs time, because how to fix the problem is not yet clear. Vercel had not responded to The Record at the time of publication. AIR found no trace of exploitation, though it cannot rule it out, and believes the flaw has existed for a long time. No CVE identifier has been issued.

The problem goes beyond Vercel. Another recent study, carried out by Perplexity and mentioned by the newsletter tl;dr sec, bypassed domain-name filtering on eight of the ten sandbox platforms tested.

Best practices

• Do not treat an allowlist of domains as a watertight barrier against exfiltration.
• Put only strictly necessary secrets in an agent sandbox, with minimal permissions and a short lifespan.
• Log agents' outbound requests and watch for unusual volumes to allowed services.
• Follow Vercel's announcements and apply the patch as soon as it is released.