# $1 million hacker challenge for Vercel Sandbox

DevFeed: [$1 million hacker challenge for Vercel Sandbox](<https://devfeed.tech/articles/1-million-hacker-challenge-for-vercel-sandbox-769.md>)

Original publisher: [Read original article](<https://vercel.com/blog/one-million-dollar-hacker-challenge-for-vercel-sandbox>)

Author: Andy Riancho

Published: 2026-08-18T13:00:00Z

Content type: article

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vercel](<https://devfeed.tech/topics/vercel.md>), [Firecracker](<https://devfeed.tech/topics/firecracker.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Network](<https://devfeed.tech/topics/network.md>), [Amazon EC2](<https://devfeed.tech/topics/amazon-ec2.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [bounty](<https://devfeed.tech/tags/bounty.md>), [firecracker](<https://devfeed.tech/tags/firecracker.md>), [linux](<https://devfeed.tech/tags/linux.md>), [network](<https://devfeed.tech/tags/network.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [security](<https://devfeed.tech/tags/security.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Vercel announces a two-week public HackerOne challenge offering up to $1 million in total payouts for researchers who can escape Vercel Sandbox isolation. The article explains that Sandbox uses Firecracker microVMs on bare-metal Amazon EC2 hosts, with host-side network controls forming part of the security boundary. Individual reports can receive up to $50,000 for vulnerabilities allowing access to another Vercel tenant's data.

## Source excerpt

Agents need to run untrusted code, and the microVM has become the standard way to do it: a dedicated guest kernel per workload, isolated from the host and from every other workload on the same machine. But recent security research and real-world incidents have revealed that agents running untrusted code do not need to cross a VM boundary to escape containment; they only need one network path the security model failed to account for, which we explained in our post A sandbox without a network boundary is only half a sandbox. Isolation only holds if both sides of it hold: the Firecracker microVM and the host-side network controls. Recently our CTO pointed an open-weight model with no safeguards at Vercel Sandbox. It did not escape, but it mapped the guest kernel, built a VM to reproduce its ideas, and wrote a fuzzer. Defenders have first-mover advantage, but it won't last forever, and the choice is when to test the boundaries (we strongly encourage building a scanning program, which you can do on any budget with an open-source tool like deepsec and AI Gateway). We are proactively choosing to test Vercel Sandbox on our own schedule, not an attacker's, and we are doing it in the open, with the best researchers in the world. So for two weeks, we are paying up to $1,000,000 USD to the researchers who can escape a Vercel Sandbox. The challenge Starting today, Vercel is running a two-week public HackerOne program focused on Vercel Sandbox isolation. Program: Public HackerOne program, open to all eligible researchers Window: Tuesday, August 18 to Tuesday, September 1, 2026, or earlier if the reward pool is exhausted Max per report: $50,000 USD, for a vulnerability that lets a threat actor read or modify another Vercel tenant's data Total pool: Up to $1,000,000 USD in total payouts Bounties are paid per report, scoped to a single root cause, and assigned by Vercel triage based on the maximum demonstrable impact. The full bounty table, detailed scope, and the list of known-dupl