What Did Vercel's Sandbox Bounty Uncover?

Guillermo Rauch says Vercel put a million dollars toward a sandbox challenge. He told the world that Vercel sandbox is one of the most secure sandboxes, if not the most secure sandbox in the world, and invited everyone to poke holes in it.

Only one person, using an army of agents, made progress. Rauch says the contribution is small but impactful: sophisticated cybersecurity skill, not a child asking Claude to hug the sandbox. Vercel is processing the contribution and sharing the finding with industry peers. It uncovered a critical vulnerability in Linux, and Rauch says almost the entire world runs in Linux. He and the researcher are direct-messaging on X and plan to keep collaborating.

Vercel is building cybersecurity harnesses and incentive systems so the company can find flaws first, protect its infrastructure, and deploy lots of tokens toward the hunt.