The 6.3 MiB Cage: Vercel fx and the $1 Million Sandbox Escape Challenge

Forum topic · QianXun · 2026-08-24

Summary

Vercel has open-sourced fx, an ultra-lightweight coding agent harness written in Zig, and launched a $1 million bug bounty on HackerOne targeting its Vercel Sandbox isolation boundaries. fx is a 6.3–6.39 MiB native binary with ~10 microsecond cold starts and single-digit-MB baseline memory, exposing four execution paths: interactive terminal, one-shot JSON queries via `fx ask --json`, editor integration via ACP over stdio, and WebAssembly embedding through `createFxAgent()`. It collects no product telemetry and keeps sessions local. Vercel Sandbox runs on bare-metal EC2 with a two-layer isolation model: each sandbox gets a Firecracker microVM with its own guest kernel, plus an inner Linux container, with the microVM as the security boundary. An egress firewall outside the microVM blocks outbound TCP/DNS and injects credentials at the boundary. The bounty program runs August 18 to September 1, 2026, paying up to $50,000 per report for demonstrated microVM escapes, tenant cross-access, or firewall bypasses—live PoCs only. Notably, CTO Guillermo Rauch pointed an unaligned open-source model at the sandbox: it failed to escape but mapped the guest kernel, built its own VM, and wrote a fuzzer, illustrating how systematically automated attacks probe isolation boundaries.

Why Coding Agents Need a "Cage"

Today's AI coding agents—helping with code review, bug fixes, and running scripts—will inevitably execute code, whether generated by the model itself or uploaded by users. That code is untrusted by default: it could contain backdoors or attempt to steal server secrets. So agents must run code inside a sandbox: an isolated room where code can thrash around without touching the real machine or other users' data.

Vercel did two things corresponding to "the cage itself" and "whether the cage is strong enough":

1. Open-sourced fx — a minimal coding agent runtime base 2. Posted a $1,000,000 bounty — a public call to "jailbreak" the cage

fx: A 6.3 MiB Base Written in Zig

fx is a coding-agent harness and CLI from Vercel Labs, licensed under Apache-2.0. Its most counterintuitive trait is how small it is:

Binary size of only 6.3–6.39 MiB
~10 microsecond cold start
Baseline memory usage in the single-digit MB range

Why write it in Zig? Because Zig compiles to native programs with no runtime, no garbage collection, and near-zero dependencies. fx's philosophy: shrink the feature surface to a minimum, then make everything else (skills, plugins, MCP) pluggable extensions.

fx exposes four execution paths from the same kernel:

Interactive terminal: run fx as a native process
One-shot calls: fx ask --json returns structured output
Editor integration: fx acp connects to editors over stdio
JS embedding: createFxAgent() / createFxTerminal() compile fx to WebAssembly for browsers or Node.js

Two privacy selling points: fx collects no product telemetry, and sessions/usage stay local—only source code and prompts go to inference endpoints. Combined with local inference, Vercel calls this "fully hermetic."

Vercel Sandbox's Isolation Architecture

Vercel Sandbox runs on bare-metal EC2, with isolation in two layers:

1. Each sandbox gets a Firecracker microVM with its own dedicated guest kernel 2. Inside the microVM, a Linux container executes code

The security boundary is the microVM, not the container inside it. Even if the container is compromised, the attacker remains trapped in the microVM, still one layer away from the host.

On the network side, the firewall runs on the host side, outside the microVM, blocking all outbound TCP and DNS by default, allowing traffic per domain/CIDR policies, and injecting credentials directly at the boundary so secrets never enter the microVM.

Vercel's blunt framing: "A sandbox without a network boundary is only half a sandbox." Isolation must hold on both the compute boundary and the network boundary.

What the $1 Million Buys

From August 18 to September 1, 2026, Vercel ran a public bounty program on HackerOne with a total pool of up to $1 million and up to $50,000 per report. The target: break the isolation boundary, in two categories:

Compute boundary:

Escape Firecracker to the host
Break into another tenant's sandbox
Disrupt a neighboring sandbox

Network boundary:

Bypass the host-side egress firewall
Reach unauthorized domains
Steal brokered credentials

Severity tiers: critical bugs that read or modify another tenant's data can earn $50K per report; medium/low severity decreases down to $1,000. Vercel explicitly requires live, demonstrable PoCs—static analysis doesn't count.

A Chilling Experiment

Vercel CTO Guillermo Rauch (known in the community as rauchg) pointed an open-source model with no safety guardrails directly at Vercel Sandbox.

Result: the model did not escape, but it did three unsettling things—

1. Mapped the guest kernel layout (probing the cage's structure) 2. Built its own VM to reproduce attack ideas 3. Wrote a fuzzer to automatically hunt for vulnerabilities

The lesson: attackers don't need a one-shot jailbreak. If they can systematically and automatically probe for cracks, they will eventually find one. The defender's first-mover advantage doesn't last forever. Vercel's choice is clear: rather than wait for attackers to strike on their own schedule, set your own timetable and invite the world's best to attack publicly.

Key Terms

> Firecracker microVM: Amazon's open-source lightweight virtual machine monitor. Each microVM has extremely low overhead and its own guest kernel—stronger isolation than traditional containers, lighter than full VMs. > > Egress firewall: controls "what can connect outward." Malicious code inside a sandbox must break through this wall before reaching the internet. > > Fuzzer: a tool that generates massive amounts of malformed inputs and watches for crashes. Attackers use it to find vulnerabilities orders of magnitude faster than manual work.

References

1. Vercel Labs, *fx: an Apache-2.0 Zig harness for coding agents* (6.3 MiB, 10µs cold start, skills/plugins/MCP, WASM embedding), 2026-08. 2. Vercel engineering blog, *$1 Million Hacker Challenge for Vercel Sandbox* (HackerOne public program, 8/18–9/1, up to $50K per report), 2026-08-18. 3. rauchg (Guillermo Rauch) public post: unguarded open-source model mapping the Sandbox, building a VM, and writing a fuzzer, 2026-08. 4. SecurityBrief / TechWalrus coverage: Vercel Sandbox Firecracker + host-side network boundary architecture and bounty scope, 2026-08-19/20. 5. AI Primer, *Vercel releases fx, a 6.3 MiB Zig harness for coding agents*, 2026-08.