Threat reportVulnerabilityTL-2026-3425
VerCellBreak: Vercel Sandbox network-allowlist bypass lets rogue AI agents exfiltrate data via crafted mTLS client certificate AIA extension (no CVE assigned)
VerCellBreak (TL-2026-3425), also tracked as VerCellBreak, is a high-severity software vulnerability, first published 2026-10-13. It has no confirmed attribution, affects Vercel Vercel Sandbox, maps to 7 MITRE ATT&CK techniques (T1048, T1048.002, T1071.001), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3425
- Threat ID
- TL-2026-3425
- Also known as
- VerCellBreak, Vercel Break
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, ai-platforms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in VerCellBreak
Malware and tooling: openssl (X.509 certificate generation with authorityInfoAccess extension)
How VerCellBreak works
AIR Security disclosed 'VerCellBreak', a technique that lets a compromised AI agent inside Vercel Sandbox leak secrets despite a domain allowlist, by embedding data in the Authority Information Access (AIA) URL of a crafted client certificate presented to an allowed server. Per AIR, Vercel classified the report as out of scope; The Record reports Vercel says it needs time to work out a patch. No in-the-wild exploitation has been reported.
Vercel Sandbox runs untrusted or agent-generated code in a Firecracker microVM on bare-metal EC2 hosts, with a Linux container nested inside the VM and a network firewall enforced at the host layer (outbound TCP and DNS filtering). Operators can restrict egress with a domain allowlist; the host-layer filter enforces that policy by inspecting TLS handshake hostnames (SNI).
AIR Security (researchers including co-founder/CTO Niv Hoffman; Nic Adams of 0rcus is also quoted) showed that this control does not cover a side channel built into standard TLS behavior. In the demonstrated attack, a compromised agent that holds credentials connects over mutual TLS (mTLS) only to an allowlisted domain (example: acme.com). The agent presents a crafted client certificate whose Authority Information Access (AIA) extension carries a URL on an attacker-controlled host with the stolen data encoded in the path (example: https://evil.com/<key_base64>.cert). The allowed server validates the certificate chain and, while doing so, fetches the 'CA Issuers' certificate from that URL. The attacker reads the secret from the request received on their server, while the sandbox never makes a direct connection to the attacker host and SNI filtering sees only the allowed hostname.
The flaw is not a memory-corruption or software bug in the sandbox; it abuses legitimate TLS/X.509 chain-building behavior of a third-party server, which is why AIR describes it as 'a very hard leak to patch'. Hoffman said the issue appears longstanding and that prior exploitation cannot be ruled out, though none was found. AIR states Vercel classified the finding as out of scope and did not accept the report because it depends on external server behavior; The Record (2026-10-13) separately reports that Vercel said it needs time to determine how to patch. These accounts differ and the final vendor position should be verified. No CVE or CVSS score has been assigned; the HIGH severity is analyst-assigned. Defender guidance from AIR: filter communication and prevent exposure of secrets to malicious content rather than relying solely on sandbox restrictions.
MITRE ATT&CK techniques used in TL-2026-3425
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1573.002 Encrypted Channel: Asymmetric Cryptography
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files
defense-impairment
Affected products and versions in VerCellBreak
- Vercel — Vercel Sandbox
Vulnerable versions: All versions as of 2026-10-13 (no version scoping stated in sources)
Remediation for VerCellBreak
Patches
- No vendor patch available as of 2026-10-13; Vercel said it needs time to develop one, and AIR reports the finding was classified as out of scope
Immediate actions
- Do not place long-lived secrets, API keys or client-certificate private keys inside agent sandboxes; use short-lived, narrowly scoped credentials
- Restrict sandbox egress allowlists to the minimum set of domains and treat every allowed endpoint as a potential relay
- Avoid allowlisting third-party servers that accept client certificates (mTLS) and will fetch AIA/CA Issuers URLs from presented certificates
- Monitor allowed destinations and any server you control for inbound AIA/CA Issuers fetches to unexpected URLs
Workarounds
- Disable or tightly limit outbound network access for sandboxes that process untrusted content or hold credentials
- Configure operator-controlled allowed servers to not dereference AIA URLs from client certificates
Longer-term hardening
- Add certificate-aware egress controls (inspect client certificate extensions, block or proxy AIA fetching) on servers that terminate mTLS for agent traffic
- Route agent egress through a credential-injecting proxy so the agent never holds raw secrets
- Threat-model agent sandboxes for indirect, relay-based exfiltration channels in addition to direct egress
Weaknesses (CWE) in VerCellBreak
Timeline of VerCellBreak
- Cloud Security Alliance Labs publishes a research note on AI coding agent sandbox escapes ('Trust Handoff Flaw'), describing escapes that exploit gaps between sandbox restrictions and trusted components outside the sandbox, the broader class context for this finding.
- Vercel opens a two-week public HackerOne bug bounty (up to $1 million pool) challenging researchers to escape its AI Sandbox (Firecracker microVM, host-layer network firewall).
- Vercel Sandbox bug bounty program period ends.
- AIR Security publishes 'VerCellBreak', demonstrating exfiltration from Vercel Sandbox via crafted mTLS client certificate AIA URLs; states Vercel classified the report as out of scope.
- AIR CTO Niv Hoffman says no in-the-wild exploitation was found, but the flaw appears longstanding and prior exploitation cannot be ruled out; calls it 'a very hard leak to patch'.
- The Record reports the flaw; Vercel says it needs time to develop a patch and is unsure of the approach.
Sources cited for VerCellBreak
- Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says
- AIR Security: VerCellBreak research report
- Vercel Stakes $1 Million on Nobody Breaking Its AI Sandbox
- Techzine: Vercel offers $1 million for hacking its AI sandbox
- CSA Research Note: AI Coding Agent Sandbox Escapes: The Trust Handoff Flaw
- Cymulate: The Race to Ship AI Tools Left Security Behind. Part 1: Sandbox Escape
Detection coverage for TL-2026-3425
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3425 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.