# VerCellBreak: Vercel Sandbox network-allowlist bypass lets rogue AI agents exfiltrate data via crafted mTLS client certificate AIA extension (no CVE assigned)

> AIR Security disclosed 'VerCellBreak', a technique that lets a compromised AI agent inside Vercel Sandbox leak secrets despite a domain allowlist, by embedding data in the Authority Information Access (AIA) URL of a crafted client certificate presented to an allowed server. Per AIR, Vercel classified the report as out of scope; The Record reports Vercel says it needs time to work out a patch. No in-the-wild exploitation has been reported.

- **Published:** 2026-10-13T16:48:15Z
- **Last reviewed:** 2026-10-13T16:48:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3425
- **ID:** TL-2026-3425
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Vercel Sandbox runs untrusted or agent-generated code in a Firecracker microVM on bare-metal EC2 hosts, with a Linux container nested inside the VM and a network firewall enforced at the host layer (outbound TCP and DNS filtering). Operators can restrict egress with a domain allowlist; the host-layer filter enforces that policy by inspecting TLS handshake hostnames (SNI).

AIR Security (researchers including co-founder/CTO Niv Hoffman; Nic Adams of 0rcus is also quoted) showed that this control does not cover a side channel built into standard TLS behavior. In the demonstrated attack, a compromised agent that holds credentials connects over mutual TLS (mTLS) only to an allowlisted domain (example: acme.com). The agent presents a crafted client certificate whose Authority Information Access (AIA) extension carries a URL on an attacker-controlled host with the stolen data encoded in the path (example: https://evil.com/<key_base64>.cert). The allowed server validates the certificate chain and, while doing so, fetches the 'CA Issuers' certificate from that URL. The attacker reads the secret from the request received on their server, while the sandbox never makes a direct connection to the attacker host and SNI filtering sees only the allowed hostname.

The flaw is not a memory-corruption or software bug in the sandbox; it abuses legitimate TLS/X.509 chain-building behavior of a third-party server, which is why AIR describes it as 'a very hard leak to patch'. Hoffman said the issue appears longstanding and that prior exploitation cannot be ruled out, though none was found. AIR states Vercel classified the finding as out of scope and did not accept the report because it depends on external server behavior; The Record (2026-10-13) separately reports that Vercel said it needs time to determine how to patch. These accounts differ and the final vendor position should be verified. No CVE or CVSS score has been assigned; the HIGH severity is analyst-assigned. Defender guidance from AIR: filter communication and prevent exposure of secrets to malicious content rather than relying solely on sandbox restrictions.

## MITRE ATT&CK

- T1048 Exfiltration Over Alternative Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1090 Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1685 Disable or Modify Tools
- T1552.001 Unsecured Credentials: Credentials In Files

## Sources

- [Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says](https://therecord.media/sandbox-vulnerability-gives-rogue-ai-agents-path-out)
- [AIR Security: VerCellBreak research report](https://www.air.security/blog-posts/vercel-break)
- [Vercel Stakes $1 Million on Nobody Breaking Its AI Sandbox](https://www.comparethecloud.net/news/vercel-stakes-1-million-on-nobody-breaking-its-ai-sandbox)
- [Techzine: Vercel offers $1 million for hacking its AI sandbox](https://www.techzine.eu/news/security/143695/vercel-offers-1-million-for-hacking-its-ai-sandbox/)
- [CSA Research Note: AI Coding Agent Sandbox Escapes: The Trust Handoff Flaw](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-coding-agent-sandbox-escapes-20260722-c/)
- [Cymulate: The Race to Ship AI Tools Left Security Behind. Part 1: Sandbox Escape](https://cymulate.com/?p=32713)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3425