# VerCellBreak: a client certificate carries data out of Vercel Sandbox > VerCellBreak is an egress bypass: a crafted mTLS client certificate turns an allowed server into the agent's exfiltration channel. - **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix. - **Category:** Attack - **Published by:** AIR Security - **Disclosed:** 2026-10-12 - **Affects:** Vercel Sandbox - **Research by:** Matan Elgabsi, Or Nevo - **Primary source:** https://air.security/blog-posts/vercel-break - **Page:** https://theinjection.dev/items/air-vercellbreak/ VerCellBreak moves data out of Vercel Sandbox past its domain allowlist. AIR Security hid a secret in a client certificate's Authority Information Access URL, and the allowed server fetched that URL while validating the chain. ## What happened AIR Security published VerCellBreak on October 12, 2026. Matan Elgabsi and Or Nevo tested Vercel Sandbox under Vercel's bug bounty program and found that a compromised agent can send a secret to an attacker-controlled server even when the sandbox firewall allows only one domain. Vercel classified the finding as out of scope and did not accept the report. ## How it works The sandbox firewall decides what an agent may reach by reading the hostname in the TLS handshake, so it only sees which domain a connection negotiates. The researchers built a client certificate whose Authority Information Access extension points at a URL such as https://evil.com/.cert, with the stolen data encoded in the path. The agent then opens a mutual TLS connection to the one allowed domain and presents that certificate. While the allowed server validates the certificate chain, it fetches the AIA URL and delivers the data to the attacker. AIR says no vulnerability was exploited on the server: the attack uses a standard TLS feature. ## Who is affected Teams running AI agents or other untrusted code in Vercel Sandbox under a user-defined network policy, where the allowlist is the control stopping data from leaving. The attack needs the agent inside the sandbox to be compromised first, and needs an allowed domain whose server requests client certificates. ## What to do Treat an egress allowlist as a way to reduce risk rather than a boundary that holds, since any allowed endpoint that takes attacker-controlled input and makes its own outbound requests can relay data. AIR recommends filtering what an agent reads so that it is not compromised in the first place. Prefer narrow, single-purpose allowed hostnames, which Vercel's own firewall documentation also advises. ## Quick facts - **Affected:** Vercel Sandbox egress allowlist - **Attack type:** Data smuggled in an mTLS certificate's AIA URL - **Found by:** Matan Elgabsi and Or Nevo, AIR Security - **Disclosed:** October 12, 2026 - **Status:** Vercel called it out of scope and did not accept the report - **Precondition:** The agent in the sandbox is already compromised ## Questions ### Has Vercel fixed VerCellBreak? Vercel has not accepted VerCellBreak as a vulnerability. AIR Security reports that Vercel classified the finding as out of scope, on the grounds that the technique depends on an external server Vercel does not operate. AIR's write-up states no fix and gives no patched version, so teams relying on the sandbox allowlist should assume the behaviour still stands today. ### Does VerCellBreak need a bug in the allowed server? No server bug is required for VerCellBreak. AIR Security writes that no vulnerability was exploited on the server side. Fetching an Authority Information Access URL during certificate chain validation is standard TLS behaviour, so an ordinary, fully patched server that requests client certificates will make the outbound request that carries the attacker's data. ### Why does the Vercel Sandbox firewall not block the request? The Vercel Sandbox firewall matches outbound traffic on the hostname in the TLS handshake, as Vercel's firewall documentation describes. In VerCellBreak the agent only ever connects to the allowed domain, so the policy is satisfied. The request to the attacker's URL comes from the allowed server, outside the sandbox, where no sandbox policy applies. ## Sources 1. [AIR Write-up](https://air.security/blog-posts/vercel-break) 2. [Sandbox Firewall Docs](https://vercel.com/docs/sandbox/concepts/firewall) 3. [Vercel Sandbox Docs](https://vercel.com/docs/sandbox)