AIR Security shows agents leaking secrets past Vercel Sandbox's allowlist

AI security startup AIR Security published research on 12 October 2026, which it calls VerCellBreak, showing how a compromised agent in Vercel Sandbox could send a secret to a server outside its domain allowlist. The sandbox checks the hostname each outbound connection negotiates. AIR's trick is a crafted mutual TLS client certificate whose Authority Information Access URL carries the encoded secret: the agent connects only to an allowed domain, and that server then fetches the URL while validating the certificate, delivering the data to the attacker. AIR says it reported this through Vercel's bug bounty programme and Vercel classified it as out of scope, because the technique depends on an outside server Vercel does not run. The Record reported on 13 October that AIR co-founder Niv Hoffman said Vercel told his team it needs time to work out a fix. According to The Record, AIR has found no evidence of exploitation in the wild but cannot rule it out.