> When a coding agent starts running other people's code on your behalf, the question is no longer "does it write good code?" but "will it burn the house down?" Vercel is publicly offering one million dollars to anyone who can escape its cage.
Why Coding Agents Need a "Cage"
Today's AI coding agents (assistants that read code, fix bugs, and run scripts) must eventually execute code—either their own generated code or user-uploaded code. That code is untrusted by default: it might carry a backdoor, or try to steal keys from your server.
So agents must run code inside a sandbox: an isolated little room where code can thrash around without touching the real machine or other users' data. The sandbox is the safe of the agent era.
Vercel did two things, corresponding to "the cage itself" and "is the cage strong enough":
1. Open-sourced fx — a minimal coding agent harness 2. Posted a $1,000,000 bounty — publicly inviting anyone to break out of the cage
> Feynman-style annotation: a sandbox is like a playpen for a mischievous child. fx builds the fence light and sturdy; the million-dollar bounty is a sign saying "if you can get the kid over the fence, here's a pile of cash" — recruiting the world's hackers to find holes in the fence early.
fx: A 6.3 MB Foundation Written in Zig
fx is a coding-agent harness and CLI from Vercel Labs, licensed under Apache-2.0. Its most counterintuitive trait is how small it is:
- Binary size: only 6.3–6.39 MiB
- ~10 microsecond cold start
- Baseline memory: single-digit MB
- Interactive terminal: the native
fxprocess - One-shot invocation:
fx ask --jsonreturns structured output - Editor integration:
fx acpconnects to editors over stdio - JS embedding:
createFxAgent()/createFxTerminal()compile fx to WebAssembly for browsers or Node.js - Compute boundary: escape Firecracker to the host; cross into another tenant's sandbox; crash a neighbor sandbox
- Network boundary: bypass the host-side egress firewall; reach unauthorized domains; steal proxied credentials
- Perspective shifts from "how smart is the agent" → "how strong is the cage when agents run untrusted code"
- Engineering shifts from "heavy Python/TS stacks" → "a 6.3 MiB native foundation in Zig"
- Security shifts from "governance (guardrails/authorization)" → "offense/defense (microVM escape + network boundary)"
Why write it in Zig, a niche systems language? Because Zig compiles to native programs with no runtime, no garbage collection, and near-zero dependencies. fx's philosophy: shrink the feature surface to the minimum, keep cold start fast and memory/context footprint small, and make everything else (skills, plugins, MCP) pluggable extensions.
fx exposes four execution paths from the same kernel:
Two privacy selling points: fx collects no product telemetry, and sessions and usage stay local—only source code and prompts go to inference endpoints. Combined with local inference, Vercel calls it fully "hermetic."
Vercel Sandbox's Isolation Architecture
To understand the million-dollar bounty, you need to see how the cage is built. Vercel Sandbox runs on bare-metal EC2, with isolation in two layers:
1. Each sandbox gets a Firecracker microVM with its own guest kernel 2. Inside the microVM, a Linux container runs the code
The security boundary is the microVM, not the container inside it. Even if the container is compromised, the attacker is still trapped in the microVM, one layer away from the real host.
On the network side, there is an independent line of defense: the firewall runs on the host side, outside the microVM, blocking all outbound TCP and DNS, allowing traffic per domain/CIDR policy, and can inject credentials at the boundary so keys never enter the microVM at all.
Vercel's blunt statement: "A sandbox without a network boundary is only half a sandbox." Isolation must hold on both the compute boundary and the network boundary.
What a Million Dollars Buys
From August 18 to September 1, 2026, Vercel ran a public bounty program on HackerOne with a total pool of up to $1 million and up to $50,000 per report. It asks for one thing only: break the isolation boundary.
Two categories of targets:
Note the severity tiers: a critical bug that can "read or modify another tenant's data" pays up to $50K per report; medium/low severities scale down to $1K. Vercel states explicitly: only live, demonstrable PoCs count—static analysis does not.
A Chilling Experiment
Vercel's CTO (Guillermo Rauch, known in the community as rauchg) did something striking: he pointed an open-source model with no safety guardrails directly at Vercel Sandbox.
Result: the model did not escape, but it did three spine-chilling things—
1. Mapped the guest kernel layout (probing the cage's structure) 2. Built its own VM to reproduce its ideas 3. Wrote a fuzzer to automatically hunt for vulnerabilities
What does this mean? An attacker doesn't need a single successful jailbreak—just the ability to systematically, automatically hunt for seams, and one will be found eventually. The defender's first-mover advantage won't last forever. Vercel's choice is clear-headed: rather than wait for attackers to set the pace, set your own timetable and invite the world's best to attack in the open.
> One-sentence takeaway: the million-dollar bounty isn't marketing—it's "trading open adversarial testing for closed trust." Put the isolation boundary under real attack firepower; if it doesn't burn through, it's ready for production.
How It Differs from Recent AI Coding Coverage
Recent weeks covered OpenAI's Instant acquisition, Matt Pocock's Skills, the harness-paradigm paper, Cloudflare's economic layer, Meta Muse Code, and AVO orchestration. fx + bounty is a different slice:
Quick Glossary: Three Security Terms
> Firecracker microVM: Amazon's open-source lightweight hypervisor. Each microVM has very low overhead and gives each workload its own guest kernel—stronger isolation than traditional containers, lighter than full VMs. > > Egress firewall: the wall governing "what can connect outward from inside." Malicious code trying to exfiltrate data must break through it first, or it can't reach the internet. > > Fuzzer: a tool that automatically feeds massive malformed inputs to a target and watches for crashes. Attackers use fuzzers to find vulnerabilities systematically, orders of magnitude faster than manual review.
References
1. Vercel Labs, *fx: an Apache-2.0 Zig harness for coding agents* (6.3 MiB, 10µs cold start, skills/plugins/MCP, WASM embedding), 2026-08. 2. Vercel engineering blog, *$1 Million Hacker Challenge for Vercel Sandbox* (HackerOne public program, 8/18–9/1, up to $50K per report), 2026-08-18. 3. rauchg (Guillermo Rauch) public post: unsafeguarded open-source model mapping the Sandbox, building its own VM, and writing a fuzzer, 2026-08. 4. SecurityBrief / TechWalrus coverage: Vercel Sandbox Firecracker + host-side network boundary architecture and bounty scope, 2026-08-19/20. 5. AI Primer, *Vercel releases fx, a 6.3 MiB Zig harness for coding agents*, 2026-08.