On August 18, 2026, Vercel opened a two-week challenge: break out of its agent sandbox between August 18 and September 1 and collect from a $1 million pool. Critical findings pay $25,000 to $50,000. High severity pays $10,000 to $25,000, medium $5,000 to $10,000, low $1,000 to $5,000. The announcement, written by Andy Riancho, carries something more reusable than the prize money: a published scope document that states exactly which failures count as an escape and which do not.
That document is the artifact worth studying. A vendor that publishes a threat model, attaches dollar figures to each class of failure, and invites the world to collect has converted a marketing claim (“our sandbox is secure”) into a falsifiable one (“here is the boundary, here is what breaking it is worth, here are two weeks to try”). Every team that runs agents on untrusted code can copy the instrument, with or without the million dollars.
What the scope includes, and what it deliberately excludes
Three classes of finding are in scope. First, a breakout from the Firecracker microVM to the bare-metal EC2 host underneath it. Second, cross-tenant compromise: reaching another customer’s workload. Third, and this is the unusual one, defeating the firewall without ever crossing the VM boundary: reaching unauthorized destinations, exfiltrating data, or retrieving credentials from inside a perfectly intact sandbox.
One class is explicitly out of scope: escapes from the container to the guest OS inside the microVM. That exclusion is as informative as the inclusions. Vercel is telling you which boundary it stakes its guarantee on. Inside the microVM, the container is a convenience layer; the hardware virtualization line and the host-side network controls are the walls the company is willing to pay for. We catalogued the trade-offs between sandbox primitives in the containment pattern essay, and the architecture here follows the strong end of that spectrum: workloads run two layers away from the host, the firewall sits outside the VM where sandboxed code cannot touch it, and credentials inject at the boundary without ever entering the microVM. That credential design is the same boundary-exchange pattern we examined in Vercel’s credential exchange model.
The threat model needs no more architecture than that. The interesting move is in the definitions.
Escape is defined at the network boundary
The word “escape” usually evokes code running on the host. Vercel’s scope widens the definition, and the announcement states the principle directly: “a sandbox without a network boundary is only half a sandbox.”
Under that definition, an attacker who never touches the hypervisor but convinces the egress layer to deliver data to an unauthorized destination has escaped. So has one who retrieves a credential that was supposed to stay outside the VM. This matches what field experience keeps showing: agents rarely need a kernel exploit when an intended feature will carry them out the front door. An agent with a working HTTP client and an overly generous allowlist exfiltrates data without violating a single isolation guarantee. Defining that as an escape, and paying for it at the same tiers as a hypervisor breakout, is the scope document’s sharpest decision.
For teams writing their own threat models, this is the line to steal. If your definition of sandbox failure stops at “code executed on the host,” half of your real risk sits outside the definition.
What the payout tiers actually price
Riancho’s framing for why the sandbox exists at all: “Agents need to run untrusted code, and the microVM has become the standard way to do it.” Accepting that premise, the question every operator inherits is how much confidence to place in the walls. Confidence is usually expressed in adjectives. Vendors say “hardened,” “isolated,” “defense in depth,” and buyers have no way to compare one adjective to another.
A bounty with a published scope expresses confidence in dollars and exposure. Vercel’s structure says: we believe a critical breach of this specific boundary is unlikely enough that we will pay up to $50,000 per finding, from a pool of $1 million, to anyone on the internet, for two weeks. That is a price on containment confidence. It can be wrong in either direction, and the two weeks will produce evidence. A quiet challenge is weaker evidence than a paid-out one, since absence of findings never proves absence of flaws. It is still categorically better evidence than an adjective.
There is a second thing the tiers price: the vendor’s own internal ranking of failure modes. Cross-tenant compromise sitting in the same scope as host breakout tells you Vercel considers tenant isolation part of the containment guarantee, and part of what it will pay to have tested. Buyers should read severity tiers the way they read an SLA: as the vendor’s written opinion of what matters.
The procurement question this hands every buyer
If you are evaluating sandbox infrastructure for agent workloads, this challenge gives you a question that cuts through datasheets: what would your vendor pay someone to break it? Vercel’s answer is $1 million over two weeks, against a written scope that includes the network boundary. A vendor with no answer is asking you to accept adjectives.
The same question points inward. If your team built its own agent runtime, could you write the scope document? Where is the host boundary, and which primitive enforces it? Where is the network boundary, and can sandboxed code reach the enforcement point? Where do credentials live, and does anything inside the sandbox ever hold one? The out-of-scope section is the hardest part to write, because it forces you to name the layers you do not stand behind. A team that cannot write it does not yet know its own boundary.
Do this now
Take the scope structure of Vercel’s challenge and rewrite it for your own agent infrastructure this week, even if no bounty money is attached. One page: in-scope escape classes, including network-boundary defeats and credential retrieval, out-of-scope layers named explicitly, and a severity ranking that reflects what you would actually pay to learn about first. Then hand it to your security team, or to a red-team engagement, as the test contract. The document costs an afternoon. It converts “we think the sandbox holds” into a claim someone can try to falsify, and that conversion, more than any single isolation primitive, is what containment confidence is made of.
This analysis synthesizes Vercel’s $1 Million Sandbox Escape Challenge (Andy Riancho, Vercel, August 2026).
Victorino Group helps engineering teams write falsifiable containment specs for their agent infrastructure, from sandbox boundaries to credential injection. Let’s talk.
All articles on The Thinking Wire are written with the assistance of Anthropic's Opus LLM. Each piece goes through multi-agent research to verify facts and surface contradictions, followed by human review and approval before publication. If you find any inaccurate information or wish to contact our editorial team, please reach out at editorial@victorinollc.com . About The Thinking Wire →
If this resonates, let's talk
We help companies implement AI without losing control.
Schedule a Conversation