Researchers at AI security startup AIR have identified a vulnerability in Vercel Sandbox, a widely used isolation environment for running AI agent code. The flaw lies in network filtering: by exploiting certificate validation, a rogue agent can cause an approved server to relay data to an attacker-controlled destination, effectively bypassing the sandbox's allowlist without ever making a direct connection to the unauthorized server.
According to AIR, the attack requires only a crafted certificate. The sandbox never communicates with the attacker's server, so from its perspective all traffic appears normal. AIR co-founder Niv Hoffman said the issue is difficult to patch and that Vercel has acknowledged it needs time to determine a fix. Vercel did not respond to a request for comment.
Nic Adams, CEO of 0rcus, said the research shows that an approved server can become an unwitting courier for stolen credentials. AIR has found no evidence that the vulnerability has been exploited in the wild, but Hoffman said it cannot rule out past exploitation and that the flaw appears longstanding.