Vercel Sandbox Flaw 'VerCellBreak' Allows AI Agents to Bypass Domain Restrictions via TLS Certificates
Security firm AIR Security disclosed a vulnerability in Vercel Sandbox where compromised AI agents can exfiltrate data by encoding it into mTLS certificate fields, bypassing domain allowlists.
ImportanceLocalEvidenceE3 inspectableWrite-upQuick
AI security firm AIR Security recently disclosed a security issue named "VerCellBreak" affecting Vercel Sandbox. Vercel Sandbox is an isolated code execution environment provided by Vercel, commonly used to run AI agents under restricted conditions. The environment typically uses Firecracker technology to create Linux micro-VMs and relies on a "domain allowlist" to limit which external servers programs inside the sandbox can connect to, aiming to prevent data exfiltration.
Researchers found that if an attacker controls an AI agent within the sandbox and has access to sensitive data, they could potentially bypass this domain restriction. The specific method involves exploiting mutual TLS (mTLS) authentication to craft special client certificates, encoding the desired exfiltrated data into the URL specified in the Authority Information Access (AIA) field of the certificate, and directing that URL to an attacker-controlled server. This means data could leak through what appears to be a legitimate encrypted handshake process, even with strict outbound traffic whitelists configured. It remains unclear whether Vercel has released a patch for this specific logic or formally acknowledged the vulnerability.