INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Sandbox AI Agent Leaks Vulnerability

| 2026-10-14 09:40 HIGH LOW DATA BREACH VULNERABILITY DISCLOSURE ATTACK ON AI SYSTEMS
JSON
Executive Summary
AI-generated
A recent study has highlighted a vulnerability in the Vercel sandboxes used by AI agents, following the recent disclosure of a data breach involving OpenAI and Anthropic models. The identified organisation behind this attack is Air Security, according to sources. This vulnerability allows an attacker to bypass network access restrictions and leak sensitive information to the outside world, even if the AI agent is not directly connected to an external attacker server. The attack works by exploiting a TLS·Certificate Extension Vulnerability, leveraging a trusted server as an intermediate leaking path. As of now, no official statement has been made regarding the current status of this vulnerability or any potential fixes being implemented by Vercel and Air Security.
Technical Mitigations AI-generated
• Patch Vercel's bug bounty program to fix the TLS·Certificate Extension Vulnerability • Block or hunt for manipulated client certificates that include encoded secret keys and attacker's server URLs • Implement a more robust network isolation mechanism, such as using a separate domain for each allowed server
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎2026/10/14
Researchers from Air Security revealed that the Vercel sandboxes' use of mutual TLS and AIA certificate extension features creates a vulnerability, allowing sensitive information to leak through an intermediate trusted server.
organisation Air Security
Air Security, Vercel Sandboxing Network Exploitation Method Revealed Using TLS·Certificate Extension Vulnerability to Leverage Trusted Server as Intermediate Leaking Path A recent study has highlighted another vulnerability in the Vercel sandboxes used by AI agents, following the recent disclosure of a data breach involving OpenAI and Anthropic models.
However, researchers from AIR Security pointed out that this domain-allowed list does not block all information leak paths.
organisation Potential Leaks of Sensitive Information
Sandboxes AI Agent Leaks Vulnerability... Possibility of Workaround through Allowed Domain, Potential Leaks of Sensitive Information.
organisation Firecracker
It utilizes Firecracker-based micro virtual machines (microVM) and allows network connections to be restricted to approved domains, thereby reducing the risk of leaking sensitive information or compromised AI agents directly connecting to the attacker's server and disclosing authentication information and secret keys.
organisation microVM
It utilizes Firecracker-based micro virtual machines (microVM) and allows network connections to be restricted to approved domains, thereby reducing the risk of leaking sensitive information or compromised AI agents directly connecting to the attacker's server and disclosing authentication information and secret keys.
organisation AIA
This latest study utilized the interaction between the mutual TLS (mTLS) and AIA (Authority Information Access) certificate extension features.
organisation Authority Information Access
This latest study utilized the interaction between the mutual TLS (mTLS) and AIA (Authority Information Access) certificate extension features.
organisation Sandboxing
Sandboxing alone is insufficient for AI security AIR Security emphasized that this case demonstrates that Sandboxing alone is insufficient to secure AI agents.
Intelligence Sources
Datanet 2026-10-14