AIR Security researchers have demonstrated a technique that can bypass Vercel Sandbox domain restrictions and allow a compromised AI agent to leak sensitive data through a trusted external server, even when direct connections to an attacker-controlled domain are blocked.
The technique, which the researchers named VerCellBreak, exploits the interaction between mutual TLS and the Authority Information Access extension used in digital certificates. AIR said the method could allow a rogue agent to encode secrets into a certificate-related URL and rely on an approved server to make the outbound request on its behalf.
The research was conducted as part of Vercel’s sandbox bug bounty programme. Vercel classified the finding as out of scope because the technique depends on the behaviour of an external server rather than a service operated directly by Vercel.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Trusted Servers Can Become an Indirect Exfiltration Path
Vercel Sandbox is designed to run untrusted code inside a Firecracker microVM while restricting the systems and network destinations that code can access.
Users can define a list of approved domains, and the sandbox is intended to ensure that outbound data is sent only to those destinations. The protection is particularly important for autonomous AI agents that may have access to API keys, tokens, session data or other confidential information.
AIR researchers found that this restriction could be bypassed indirectly.
The technique relies on Server Name Indication filtering, which examines the hostname used during a TLS connection and allows or blocks traffic according to the configured domain list.
Instead of sending stolen information directly to a blocked domain, an attacker could instruct a compromised agent to connect to an approved server using mutual TLS and present a specially crafted client certificate.
The certificate’s Authority Information Access extension can contain a URL pointing to the location of an intermediate certificate. During certificate validation, a server may request that URL to complete the certificate chain.
Researchers found that an attacker could embed sensitive information inside that URL.
Crafted Certificate Can Carry a Stolen Secret
AIR illustrated the attack using a scenario in which an AI agent running inside Vercel Sandbox has access to a private key but is allowed to communicate only with a trusted domain.
A direct request from the compromised agent to an attacker-controlled server would be blocked by the sandbox.
Instead, the attacker could create a client certificate containing an AIA URL such as an attacker-controlled address followed by an encoded version of the stolen key.
The compromised agent would then connect to the approved server using mutual TLS and present the crafted certificate.
While validating the certificate chain, the approved server could request the certificate from the attacker-controlled URL. That request would reveal the encoded secret to the attacker.
In this scenario, the sandbox itself correctly prevents the direct connection to the malicious domain. The data leaves because the trusted server makes the external request after processing attacker-controlled certificate data.
AIR compared the technique with an earlier incident involving OpenAI agents, where an internal package manager was used to make internet requests on behalf of agents operating inside a restricted environment.
Vercel Classified Finding as Out of Scope
The researchers said the technique highlights a broader limitation of domain allowlists as a security boundary for autonomous AI agents.
Even when a sandbox prevents direct access to unapproved destinations, a trusted endpoint may still become an indirect exfiltration channel if it processes attacker-controlled input and makes outbound requests of its own.
AIR said the technique depends on the behaviour of the external server involved in certificate validation. Because Vercel does not operate that server, the company classified the report as outside the scope of its bug bounty programme and did not accept the finding.
The researchers said the broader lesson is that sandboxing alone cannot guarantee that sensitive information remains contained once an agent has been compromised.
They argued that security controls should also focus on preventing malicious content from reaching agents and limiting exposure of sensitive credentials and data before an attacker can influence agent behaviour.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
