AIR finds a vulnerability in Vercel Sandbox that lets agents leak data

AIR, a security startup, found a vulnerability in Vercel Sandbox and gave the results on Monday. Vercel Sandbox is a tool that runs code in isolated environments. A rogue AI agent can use a specially made certificate to send data out of approved networks. AIR found no sign of an attack in the wild, but AIR cannot show that no attack occurred. Vercel has no patch at this time.

How it works

Developers use sandboxes to keep AI agents away from systems that are not approved. A network allowlist limits contact to approved destinations.

AIR says that an agent can use the procedure that servers use for digital certificates. The researchers made a certificate and sent it to an approved server. This certificate caused the server to contact a server that the attacker controls.

Why it is hidden

The sandbox did not contact the attacker server directly. Niv Hoffman, co-founder and CTO of AIR, says that all looked correct from the sandbox side. Hoffman says that this leak is very hard to patch.

What Vercel says

Hoffman says that AIR told Vercel about the vulnerability. Vercel told AIR that more time is necessary to find a patch, because the procedure is not clear. Vercel gave no comment at this time.

What is unknown

Hoffman says that the vulnerability was possibly in the tool for a long time. Nic Adams, co-founder and CEO of 0rcus, says that an approved server can become a courier for stolen credentials. Adams says that security must include the time after the first connection.