AIR Security Says a Crafted Certificate Can Carry Secrets Past Vercel Sandbox’s Domain Allowlist

Researchers at AIR Security, an AI agent security startup, say they found a way for a rogue AI agent to sneak secrets out of Vercel Sandbox even when its network is locked down to a short list of approved websites. In a blog post published on 12 October 2026, Matan Elgabsi and Or Nevo called the technique “VerCellBreak” [1]. Vercel has not commented publicly, and AIR’s own account of how Vercel responded differs from what its chief technology officer told The Record [1][2].

What Vercel Sandbox is meant to do

Vercel Sandbox is a service for running untrusted code, including code written or run by AI agents, inside an isolated virtual machine. One of its protections is a firewall: the user lists the domains the sandbox may talk to, and everything else is blocked [1][3]. The idea is simple. If an agent is tricked into going rogue, it may hold your keys and tokens, but it has nowhere to send them.

SNI and mutual TLS, in plain terms

Most web traffic is encrypted with TLS. At the very start of a TLS connection, before encryption kicks in, the client says which website it wants to reach. That label is called SNI, short for Server Name Indication. Vercel’s documentation says its firewall matches HTTPS traffic by reading that SNI hostname [3]. In other words, it checks the name on the envelope, not what is inside.

Normally only the server proves who it is, by showing a certificate. With mutual TLS, or mTLS, the client must also show a certificate. Some services use this to make sure only approved machines can connect. To check a certificate, the server needs the chain of certificates that vouch for it. AIR explains that a certificate can carry a web address, in a field called Authority Information Access (AIA), telling the server where to download a missing link in that chain [1].

How AIR says the bypass works

According to AIR, the steps look like this [1]:

• An agent inside the sandbox is only allowed to reach one trusted domain, and that domain asks clients for mTLS.
• An attacker who has taken over the agent tries to send a secret key straight to their own server. The sandbox blocks it, as designed.
• The attacker then makes a fake client certificate whose AIA address points to their own server, with the secret hidden inside the address itself.
• The agent connects to the allowed domain and presents that certificate. The firewall sees an approved name and lets it through.
• While checking the certificate chain, the allowed server goes to fetch the address in the AIA field. That request lands on the attacker’s server, and the secret arrives with it.

The sandbox never talks to the attacker directly, AIR says. The trusted server does it for the agent. “No vulnerability was exploited on the server. We simply leveraged a standard TLS feature, yet the secret still got out,” the researchers wrote [1]. AIR also notes that the trick depends on the allowed server being willing to fetch certificates this way, and calls AIA “a niche feature” [1].

How Vercel responded: two accounts

AIR says it found the issue through Vercel’s bug bounty programme, which pays outside researchers for reporting flaws [1]. According to AIR’s post, because the technique depends on an outside server that Vercel does not run, Vercel classed the finding as out of scope and did not accept the report [1].

Speaking to The Record, AIR co-founder and CTO Niv Hoffman gave a different picture. He said Vercel told his team it needs time to find a patch, because “it’s unclear for them right now how it’s going to be done” [2]. “It’s a very hard leak to patch,” Hoffman added [2]. The Record said Vercel did not immediately respond to its request for comment [2], and TSN has not found any public statement from Vercel.

Has anyone used it?

There is no evidence that it has been used in real attacks. Hoffman told The Record that AIR has found no sign of exploitation in the wild but cannot rule it out [2].

What this means

• Allowlists check names, not behaviour. Vercel’s own docs already warn that filtering on SNI has limits, for example with a trick called domain fronting [3]. AIR’s research points to another way an approved destination can be used to pass data on.
• The claims are AIR’s. No one has independently reproduced the technique, and Vercel has not set out its position publicly.
• Pick allowed domains with care. AIR’s advice is that any trusted endpoint that handles attacker-controlled input and makes its own outbound requests can become a leak path, so filtering what an agent reads matters as much as sandboxing it [1].

Sources

1. AIR Security (Matan Elgabsi, Or Nevo), “VerCellBreak: How we escaped Vercel’s hardened sandbox”, 12 October 2026. https://www.air.security/blog-posts/vercel-break
2. The Record from Recorded Future News (Suzanne Smalley), “Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says”, 13 October 2026. https://therecord.media/sandbox-vulnerability-gives-rogue-ai-agents-path-out
3. Vercel documentation, “Sandbox firewall”. https://vercel.com/docs/sandbox/concepts/firewall

Related stories

• AI Agent Security: Langflow’s Critical Flaw, Copilot’s Encrypted-Instruction Finding and the New Guardrails
• AI Agent Security: A Hijacked SDK Goes After Agent Keys as Copilot, Bitdefender and Citadel Add Guardrails
• Vercel’s eve Is an Open-Source Framework for Building AI Agents; It Is in Public Preview, and the Claims Are Vercel’s
• Pine AI Launches Pine Computer, a Sandboxed Cloud Computer for AI Agents, in Private Beta