AI Sandbox Vulnerability Exposes Sensitive Data via Certificate Exploitation
Cybersecurity researchers at AI security startup AIR uncovered a critical vulnerability in Vercel Sandbox, a widely used tool for running AI code in isolated environments. The flaw, disclosed on Monday, allows rogue AI agents to bypass network restrictions and leak sensitive data by exploiting weaknesses in certificate validation processes.
Sandboxes are designed to prevent AI agents from accessing unauthorized systems or transmitting data to untrusted destinations. Typically, network allowlists restrict communication to approved servers. However, AIR’s research demonstrated that attackers could craft a malicious certificate to trick an approved server into relaying data to an attacker-controlled server without the sandbox ever directly contacting the unauthorized destination.
“This vulnerability shows that enterprises could face Hugging Face-style incidents with their own AI agents,” said Niv Hoffman, AIR’s co-founder and CTO. “Even in hardened sandboxes, flaws exist that allow rogue agents to escape and operate in the wild.”
The attack works by sending a specially designed certificate to an approved server, which then unwittingly forwards requests to an external attacker-controlled server. From the sandbox’s perspective, the communication appears legitimate, making the exploit difficult to detect. Hoffman described the flaw as “a very hard leak to patch”, noting that Vercel acknowledged the issue but has yet to determine a fix.
While no active exploitation has been confirmed, AIR cannot rule out prior misuse, suggesting the vulnerability may have existed for some time. Nic Adams, CEO of 0rcus, emphasized the broader security implications: “An approved server can become an unwitting courier for stolen credentials. Security must account for what happens after the first connection.”
Vercel has not yet responded to requests for comment. The discovery highlights persistent risks in AI sandboxing, even in widely trusted development environments.
Source: https://therecord.media/sandbox-vulnerability-gives-rogue-ai-agents-path-out
Vercel TPRM report: https://www.rankiteo.com/company/vercel
"id": "ver1791915986",
"linkid": "vercel",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology/AI Development',
'name': 'Vercel',
'type': 'Company'}],
'attack_vector': 'Certificate Exploitation',
'data_breach': {'data_exfiltration': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Sensitive data'},
'date_publicly_disclosed': '2023-11-20',
'description': 'Cybersecurity researchers at AI security startup AIR '
'uncovered a critical vulnerability in Vercel Sandbox, a '
'widely used tool for running AI code in isolated '
'environments. The flaw allows rogue AI agents to bypass '
'network restrictions and leak sensitive data by exploiting '
'weaknesses in certificate validation processes. The attack '
'works by sending a specially designed certificate to an '
'approved server, which then unwittingly forwards requests to '
'an external attacker-controlled server.',
'impact': {'brand_reputation_impact': 'Potential brand reputation damage',
'data_compromised': 'Sensitive data',
'systems_affected': 'Vercel Sandbox'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Enterprises must account for vulnerabilities in AI '
'sandboxing environments, even in widely trusted '
'development tools. Security must consider what happens '
'after the first connection in network communications.',
'post_incident_analysis': {'root_causes': 'Weaknesses in certificate '
'validation processes allowing '
'rogue AI agents to bypass network '
'restrictions'},
'recommendations': 'Patch vulnerabilities in certificate validation '
'processes, enhance monitoring for unusual '
'certificate-based communications, and conduct thorough '
'security reviews of sandbox environments.',
'references': [{'source': 'AIR Security Research'}],
'title': 'AI Sandbox Vulnerability Exposes Sensitive Data via Certificate '
'Exploitation',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'Weaknesses in certificate validation processes'}