Vercel Sandbox Certificate Bypass Enables Rogue AI Agent Exfiltration via Approved Hosts

The vulnerability exploits certificate validation logic in TLS handshakes. An agent inside the sandbox submits a specially constructed certificate to an allowlisted destination, which then initiates a callback to an attacker-controlled endpoint. Network monitors register only the initial approved connection, masking the data transfer. AIR confirmed the issue affects standard hardened configurations used by enterprises running isolated model inference and agent workflows.

This pattern aligns with prior container escape research documented in Kubernetes and Docker CVEs where indirect channel abuse defeated egress controls. Unlike those cases, here the approved server becomes an unwitting relay, complicating detection and logging. The absence of direct sandbox-to-malicious-host traffic matches the technical attribution criteria that distinguish observable packet flows from operational claims of isolation.

Vercel acknowledged the report but stated no immediate patch path exists. AIR observed no in-the-wild exploitation yet noted the flaw's longevity suggests prior undetected use. Related work from 0rcus and earlier Hugging Face supply-chain incidents indicates enterprises continue to underestimate post-connection relay risks in agent runtimes.

Next steps include independent verification of similar validation paths in competing sandboxes and procurement records showing which defense contractors rely on Vercel for classified model testing.