AI security startup AIR disclosed a network-filtering flaw in Vercel Sandbox on Monday that could let a rogue AI agent move sensitive information beyond approved network boundaries.
AIR found no evidence of exploitation in the wild. Niv Hoffman, the startup’s co-founder and CTO, told The Record that he could not rule out the possibility that exploitation had occurred.
The allowlisted server provides the second hop
Vercel Sandbox runs code in isolated environments. Its network allowlist is intended to restrict communications to approved destinations, preventing agents from connecting directly to untrusted infrastructure.
According to The Record’s account of AIR’s research, the flaw exploits certificate-validation behavior to create an indirect route outside that boundary.
In the researchers’ demonstration, an agent sends a specially crafted certificate to an approved server. That server then issues a request to an attacker-controlled system, enabling information to leave the permitted network without the sandbox directly contacting the unauthorized destination.
From the sandbox’s perspective, the agent communicated only with an allowlisted server. The control fails to account for the subsequent request initiated by that trusted endpoint.
Nic Adams, co-founder and CEO of cyberkinetics company 0rcus, characterized the approved server as an “unwitting courier for stolen credentials.” The finding shows why validating the initial destination may not be enough when that destination can relay data or initiate further connections.
Hoffman described the flaw as “a very hard leak to patch” and said it appeared to be longstanding. He also compared the potential consequences to small, organization-specific incidents resembling exposure involving AI development platforms. That comparison was a risk analogy, not a report of a Vercel Sandbox breach.
Vercel’s patch plan remains unsettled
Hoffman said AIR contacted Vercel and was told that the vendor needed time to develop a patch because the implementation had not yet been determined. Vercel did not immediately respond to The Record’s request for comment.
The Record’s account does not identify an affected Vercel Sandbox version range or a fixed release. It therefore provides no version threshold that operators can use to classify a deployment as unaffected.
The account also does not document an interim vendor workaround. Security teams evaluating exposure should treat an approved first-hop connection as insufficient proof that an agent’s data remains within authorized boundaries. In particular, they can examine whether allowlisted services are able to trigger requests to additional destinations and restrict the sensitive information available to sandboxed agents where operationally feasible. These are risk-reduction measures, not a vendor-confirmed fix for the underlying flaw.
