Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says

Cybersecurity researchers on Monday said they discovered a vulnerability in a widely used AI development sandbox that could allow rogue agents to leak sensitive information by bypassing restrictions designed to keep them isolated.

The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation processes to transmit data outside approved networks.

“This vulnerability shows that enterprises can have Hugging Face [style] mini incidents with their own agents,” Niv Hoffman, AIR co-founder and CTO, told Recorded Future News in an interview.

“The new contribution our research makes is [showing] that even in the standard hardened sandbox of today, there are still flaws that will make an agent going rogue manage to escape the sandbox and do things in the wild.”

Developers typically use sandboxes to prevent AI agents from accessing unauthorized systems or transmitting sensitive information. Network allowlists restrict communication to approved destinations, preventing agents from connecting to untrusted servers.

AIR researchers found that rogue agents could circumvent those restrictions by exploiting the way servers handle digital certificates. In a scenario demonstrated by the researchers, a specific certificate was designed that could be sent to an approved server and could then trigger a request to an attacker-controlled server, allowing the information to be transmitted without the sandbox ever directly communicating with the unauthorized destination.

“A crafted certificate is all it takes,” the report said. “The wall meant to keep your secrets in has a door, and the agent holds the key.”

“It’s a very hard leak to patch,” Hoffman said. “This sandbox never communicated directly with the attack server… so from the sandbox perspective, everything looked fine.”

Hoffman said his team contacted Vercel about the vulnerability and the company said it needs time to find a patch because “it’s unclear for them right now how it’s going to be done.”

Vercel did not immediately respond to a request for comment.

AIR has not found evidence of any exploitation of the vulnerability in the wild, but can’t rule out whether or not there has been one, Hoffman said, underscoring that the vulnerability in the Vercel sandbox appeared to be longstanding.

The research is important because it shows that an approved server can become an “unwitting courier for stolen credentials,” according to Nic Adams, co-founder and CEO of 0rcus, a cyberkinetics company. “Security has to account for what happens after the first connection.”