$1 million hacker challenge for Vercel Sandbox - Vercel

kept by eddie aug 19

Vercel launches a two‑week public HackerOne bounty offering up to $1 million for researchers who can escape its Sandbox microVM isolation.

What the bliss taught us
curl maintainers took July off from vulnerability reporting, finding relief, improved productivity, and no negative impact, deeming the experiment successful.
also on HackerOne, #security, #open-source, #developer-tools
Notion AI: Unpatched data exfiltration
Notion AI allowed data exfiltration via indirect prompt injection in March 2025, where edits were saved before user approval, enabling attackers to steal sensitive document contents.
also on HackerOne, #security
Security boundaries in agentic architectures - Vercel
Vercel recommends separating agent harness from generated code execution in isolated sandboxes with secret injection to prevent prompt injection and credential theft in agentic architectures.
also on Vercel Sandbox, Vercel, #security, #developer-tools
Boring Computers
Boring Computers delivers instant Firecracker microVMs with snapshot-restore in ~3 ms, a terminal, browser, coding agents, and an AI driver, all open source.
also on Firecracker, #cloud-computing, #open-source, #developer-tools
A field guide to sandboxes for AI
Sandboxing tools for AI agents differ fundamentally by boundary (containers, gVisor, microVMs, Wasm), not just by policy, and picking the wrong one creates either leaks or excessive cost.
also on Firecracker, #security, #developer-tools