Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says

Cybersecurity researchers on Monday said they discovered a vulnerability in a widely used AI development sandbox that could allow rogue agents to leak sensitive information by bypassing restrictions designed to keep them isolated. 

The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation processes to transmit data outside approved networks.

“This vulnerability shows that enterprises can have Hugging Face [style] mini incidents with their own agents,” Niv Hoffman, AIR co-founder and CTO, told Recorded Future News in an interview.

“The new contribution our research makes is [showing] that even in the standard hardened sandbox of today, there are still flaws that will make an agent going rogue manage to escape the sandbox and do things in the wild.” 

Developers typically use sandboxes to prevent AI agents from accessing unauthorized systems or transmitting sensitive information. Network allowlists restrict communication to approved destinations, preventing agents from connecting to untrusted servers.

AIR researchers found that rogue agents could circumvent those restrictions by exploiting the way servers handle digital certificates. In a scenario demonstrated by the researchers, a specific certificate was designed that could be sent to an approved server and could then trigger a request to an attacker-controlled server, allowing the information to be transmitted without the sandbox ever directly communicating with the unauthorized destination.