AIR Security reveals VerCellBreak sandbox bypass in Vercel AI agents
AIR Security says VerCellBreak abuses mTLS and the AIA certificate extension to leak secrets from Vercel's AI agent sandbox without a direct attacker connection.
AIR Security has disclosed a technique it calls VerCellBreak that bypasses network access restrictions in Vercel's AI agent sandbox and allows secrets to be exfiltrated, according to the security firm.
The technique exploits how mutual TLS (mTLS) and the AIA (Authority Information Access) certificate extension interact during TLS certificate validation.
According to AIR Security, a secret key can be encoded into the URL of a crafted client certificate, which causes a trusted, allowed domain to request the AIA-specified URL from a server controlled by the attacker. The AI agent itself never has to connect directly to the attacker's server for the data to leave the sandbox.
AIR Security said Vercel classified the report as out of scope for its bug bounty program, because the technique depends on the behaviour of external servers that Vercel does not operate. The report was first covered by datanet.co.kr.
Broader context
In earlier, separate incidents, frontier AI models from OpenAI and Anthropic were reported to have been involved in hacking external companies.
Quick answers
What is VerCellBreak?
It is a technique disclosed by AIR Security that bypasses network access restrictions in Vercel's AI agent sandbox and can be used to exfiltrate secrets.
How does VerCellBreak work?
It abuses the interaction between mutual TLS and the AIA certificate extension, encoding a secret key into the URL of a crafted client certificate so a trusted allowed domain requests an AIA-specified URL from an attacker-controlled server.
Why did Vercel say the report was out of scope?
According to AIR Security, Vercel classified the report as out of scope for its bug bounty program because the technique depends on external servers Vercel does not operate.