Vercel paid $242,000 of its $1 million sandbox bounty

What Vercel found when it paid people to break its sandbox

Vercel Sandbox runs untrusted code, such as code an AI agent wrote, inside small isolated virtual machines. In August, Vercel offered up to $1 million (opens in a new tab) to anyone who could break out of it. Earlier this month it came back and published the results (opens in a new tab): it paid $242,000, about a quarter of the headline, and it explained what that money bought. That explanation is the story, because a headline number only promises a ceiling, and the write-up shows what the money was actually paid for.

This week CodeRabbit put up its own $1 million, but as free security scans rather than payment for bugs.

What the million promised

A bug bounty pays outside security researchers for each flaw they can prove. Vercel ran this one for two weeks (opens in a new tab) on HackerOne, the platform that handles the reports and the payouts, and the million was the most it would pay in total. The biggest payments were for reading or changing another customer’s data, and Vercel would not pay for findings from reading code alone (opens in a new tab): it needed to see the boundary break.

The launch post (opens in a new tab) also made a promise:

After the program closes, we will publish a follow-up writeup of the techniques and the fixes we shipped.

We asked in August and September whether Vercel would keep that promise, and it did.

What the write-up says

Of 1,285 reports (opens in a new tab), most were noise, because they repeated a bug someone had already filed or fell outside the rules. Once Vercel had sorted them, 57 valid bugs were left, and only one was rated critical.

The post names the worst of them, including ones that embarrass Vercel:

A flaw in Linux itself. On the third day, Paulos Yibelo found a defect in the networking code of the Linux kernel, the core of the operating system on the host, which is the machine each sandbox runs on. Crafted packets sent from inside a sandbox could leak memory from the host, crash it or run code on it, and Vercel says the leak was demonstrated against its production sandboxes (opens in a new tab). It’s a zero-day, a flaw found before any fix existed, and the patches are not public yet.
An intern’s find. Marcos Hernanz, an intern at Vercel, found a leak in the Linux storage layer (opens in a new tab) that let any sandbox read leftover disk blocks from sandboxes deleted before it, so data from one customer could reach another. That is a leak between customers, found by Vercel’s own staff, and Vercel printed it beside the outside researchers’ bugs.
A snapshot crossed accounts. A snapshot is a saved copy of a sandbox. One researcher showed (opens in a new tab), using two accounts of their own, that snapshots could be swapped from one account to the other, because the host believed what software inside the sandbox, called the guest, told it. The fix shipped within a week, and each snapshot is now tied to its project.

Vercel draws the lesson from that last bug in one line:

The guest is where our customers (and hackers) run untrusted code, so the host can never take its word as authoritative.

A team buying a sandbox for its agents wants that sentence, and it carries weight because the bug behind it is printed too.

Those bugs show what an attacker could have reached, and that is different from what anyone did reach: Vercel says no report showed (opens in a new tab) anyone actually reading a customer’s data. Separately, Trail of Bits, a security firm Vercel hired for a separate review, with the full source code, concluded that the wall between the sandbox and its host is sound. (Both claims are Vercel’s own account.)

Where the story is weaker than it looks

There are reasons to hold the praise a little. First, the final numbers are smaller than the ones Vercel gave the press while it was still sorting reports. In September, SecurityWeek reported (opens in a new tab) Vercel’s count mid-way through: about $325,000 committed and two flaws in the kernel’s networking code. The final post names one such flaw and $242,000 paid, and does not say why.

Second, publishing a result has been done before. Early last year Anthropic ran a public challenge on HackerOne to jailbreak its model, that is, to get it past its safety rules, and closed it with a tally (opens in a new tab) of the winners and the $55,000 it paid them. That was a fixed prize rather than a pool, but it was the same move, and standing programs such as GitLab’s (opens in a new tab) report yearly.

Third, almost nobody noticed: on Hacker News the write-up drew a handful of votes and no comments (opens in a new tab). So an honest write-up still has to be promoted like a launch.

CodeRabbit is giving away scans, capped per team

CodeRabbit, an AI tool that reviews pull requests, put up its own $1 million (opens in a new tab) this week. The money pays for Deep Scan, its scan of a whole repository for flaws an attacker could use. Any team account with more than one member can claim it, including open-source projects and teams that have never been customers. It’s first come, first served until the money runs out or the offer closes on 8 November.

The next line sets the limit (opens in a new tab): each team can claim up to $5,000. CodeRabbit does not do the arithmetic, so here it is: if every team took the full amount, the pool would cover 200 teams, and it reaches more only if most teams use less.

How much scanning does a team’s share buy? That’s hard to say, because Deep Scan is billed in credits: CodeRabbit quotes an estimate before each scan and charges the final amount after it, and the docs (opens in a new tab) give no price per scan. The post also makes no promise to report how much of the pool was claimed, and what the scans find goes only to each team.

So the two numbers measure different things. Vercel set its million as the most it would pay for bugs other people found, while CodeRabbit set its own as the most free usage it will give away.

Our take

Our take: before you put a big number in a launch headline, decide what you’ll publish when the campaign ends, because the number on its own is only a ceiling. For a bounty, money left unpaid is evidence. Vercel kept most of its million, and the write-up tells you why: the sandbox mostly held, and the post says where it gave way. For a credits pool, money left over only means fewer people came.

There is a fair argument the other way. Vercel did not pay for findings from reading code alone, so a low payout can mean strict rules as much as a strong sandbox. What would change our mind about publishing is a vendor that put out a frank result like this and lost customers over it.

CodeRabbit now faces the same test. If it says, once the offer closes, how many teams claimed the money and what the scans turned up, its million becomes the same kind of evidence.

Railway told customers about a security incident with a separate page for each key to change

Railway, a platform where developers deploy apps and databases from a git push, disclosed a security incident (opens in a new tab) on Wednesday. Environment variables are the settings where developers keep an app’s API keys and database passwords. Railway said it had found unusual activity in the systems that store them, and that an attacker may have read some of them in decrypted form. So it paused all new deployments and told every user to rotate every variable, which means replacing each key with a new one and cancelling the old.

The preliminary report (opens in a new tab) the next day put the exposure at fewer than one in fifty workspaces, which are team accounts on Railway. It says the attacker stayed out of user accounts, but Railway is still checking whether source code was read. Railway also says the attack was after API keys for AI providers, to use for distillation: training a cheaper model on the answers of a stronger one. (That motive is Railway’s account alone.)

What’s worth studying is the format. Instead of one long post, Railway put up 15 short pages on its blog (opens in a new tab) (our count), each one action: rotate your database passwords, check AWS, GCP and GitHub for unfamiliar access, and check Stripe and each AI provider for unexpected usage. The Anthropic page (opens in a new tab), for example, walks you through revoking the key in the Claude Console, replacing it on Railway and redeploying, then reading usage and cost by key for traffic that looks unlike yours. Each AI provider getting its own page is the detail of the moment, because a leaked key there is a bill that keeps running.

On Hacker News (opens in a new tab), commenters complained about Railway’s timing. The timeline in the report shows Railway warned the providers behind the exposed keys (opens in a new tab), such as Anthropic and Stripe, about 11 hours before it told customers (our arithmetic). The report’s FAQ says it waited until the attacker was out of its systems, so that the keys customers rotated would stay safe.

New deploys also stayed paused for about two days (opens in a new tab), with paid plans getting them back first, while apps already running stayed up throughout. That mattered because a new key reaches a running app only when it redeploys, as the Anthropic page’s own steps show. In the thread on the disclosure (opens in a new tab), another commenter objected that Railway told customers to rotate their keys without saying, in the same message, that they could not redeploy.

For comparison, CircleCI, a CI service, told every customer to rotate their secrets in 2023, nearly a week (opens in a new tab) after its first alert and in one general instruction. Railway told its customers sooner and told them more exactly what to do. Its report promises a follow-up when the investigation ends, and that is where the cause, still unpublished, should appear.

Parallel printed its own API answers on billboards, and links the research behind each one

Parallel, a company that sells web search to AI agents, is running what it calls its first major out-of-home campaign (opens in a new tab): billboards, transit posters and station screens in New York, the San Francisco Bay Area and London this fall and winter. The ads are six collages about subjects like the monarch butterfly migration and the Shinkansen, and each one comes with the research it started from, which Parallel describes like this:

Each of the six compositions is grounded in a real research run, with part of the API response sitting inside the artwork.

Here’s how it worked: the team wrote a research brief for each subject, ran it through the Task API, the Parallel product that turns a brief into a cited report, and put part of the structured answer into the design. The post links each collage to its report, and a companion site, Parallel Archives (opens in a new tab), shows the brief, the report and the full JSON output behind every poster.

Two things temper it, though. The posters are not raw output: the post says the designs were reworked through repeated iteration as the research turned up new sources. And the post gives no start date, spend or reach for the campaign.

Briefly

Anthropic gave the Agent Skills standard to the Linux Foundation. Agent Skills is a format for packaging instructions and scripts that an AI agent can load. Anthropic is handing the standard’s name, logo, GitHub organization and domain to the Agentic AI Foundation (opens in a new tab), part of the Linux Foundation. It says a million skills have been published (its own figure, with no method). Giving away the name lets rivals adopt the format without carrying the Anthropic brand.

Meta asks for a credit line in its open model license. The license for Muse Spark Open (opens in a new tab), Meta’s open-weights model, requires products to display “Built with Muse Spark Open”, and a licensee earning over $20 million a year must sign a separate agreement before selling access to it as an API. So every product built on it carries Meta’s model name.

GitHub now names MCP servers in Copilot usage reports. MCP servers are the usual way coding agents connect to outside tools. The Copilot usage metrics API (opens in a new tab) now reports skills, custom agents and MCP servers by the names a company gave them, and a day later it added a count by tool (opens in a new tab), Claude Code and OpenCode included. GitHub says the first can undercount and calls the second a best-effort grouping, but a buyer can now see whether their team uses your MCP server.

Everything else this week

Launch

10-24 Resend launches Forge, its own mail transfer agent (opens in a new tab)

Release · 3

News · 3

Funding

10-24 Daytona raises $60M Series B at a $1B valuation (opens in a new tab)

Campaign · 5

Practice

10-20 Stripe : AI pricing is layered, not single-model, and keeps moving (opens in a new tab)

Sources, check them yourself

Every load-bearing claim above links to one of these. A single-sourced claim says so in the text.