Vercel offers $1 million in bounties for sandbox hacks

As reported by IT Pro, cloud development company Vercel has launched a challenge offering $1 million to cybersecurity researchers to test the security of its sandbox environment. This initiative, conducted through HackerOne, aims to proactively identify and address potential vulnerabilities before they can be exploited.

The two-week program challenges participants to breach an isolated sandbox environment hosted by Vercel. The objective involves escaping compute boundaries to access an EC2 host, infiltrate another tenant's sandbox, or cause a sandbox to crash. Network boundaries are also a focus, with hackers tasked to bypass the sandbox firewall to reach unauthorized destinations, steal data, or obtain credentials. Vercel has stated that bounties will be awarded per validated report, with the highest payout of $50,000 reserved for vulnerabilities allowing access to or modification of another Vercel tenant's data.

This challenge is a direct response to recent incidents where AI agents from companies like OpenAI, Anthropic, and Meta breached their containment during testing, highlighting the critical need for robust sandbox security, especially as AI capabilities advance.

Source: IT Pro