AIR Security reports a controlled demonstration of data leaving Vercel Sandbox through an allowed external service, despite a domain allowlist blocking a direct connection to the researchers’ receiver. The external service made an onward request while processing agent-controlled certificate data. This is an indirect egress finding, not a demonstrated VM escape or an observed rogue-agent incident; AIR says Vercel classified the report as outside its bounty scope because the technique depends on a server Vercel does not operate.
Containment needs to account for what allowed destinations can do on an agent’s behalf, as well as which direct network connections are blocked.
Key facts
As stated in the sources, with where to find them.
- AIR says its research focuses on domain-based outbound filtering. Its demonstration assumes an agent or code execution has already been compromised.The Sandbox; Let’s get technical
- AIR describes an illustrative scenario in which an allowed service’s certificate-validation behavior provides an onward data-leak path while the sandbox blocks the direct disallowed connection. AIR says it used a standard TLS feature rather than exploiting a flaw in that external server.mTLS and AIA
- The technique depends on behavior of the allowed external service. AIR says Vercel did not accept the report under its bounty scope because Vercel does not operate that service. The post provides no independent reproduction or deployed-agent incident rate.Limitations
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.