Vercel reports results of $1M Sandbox bug bounty challenge, including a Linux kernel networking vulnerability
Vercel published findings from its $1M public challenge inviting researchers to escape Vercel Sandbox, which ran in August. Vercel reports 1,285 reports received in two weeks, $242,000 paid in bounties, and no reports showing access to customer data; the most severe finding was a Linux kernel networking defect, with fixes and CVEs pending.
Why it matters
Sandboxes that run untrusted code share host infrastructure, so kernel-level flaws affect shared-infrastructure risk across cloud providers. Builders running code in sandboxes can see how vendors handle isolation, patching, and disclosure.
Who should care
Developers and platform teams running untrusted code in sandboxes or microVMs, security engineers, and ecommerce brands relying on serverless or sandboxed execution.
What you can do
Review your sandbox and microVM isolation assumptions, and track the pending Linux kernel CVEs and patches for any Firecracker or KVM workloads you run.