Vercel 悬赏 100 万美元挑战沙箱逃逸，收到 1285 份报告并发现一个 Linux 内核零日
This is one of the most exhilarating times in technology, and this challenge was yet another jaw-dropping moment.
Vercel 悬赏 100 万美元征集逃逸 Vercel Sandbox 的方案，共收到 1285 份报告，支付 24.2 万美元赏金，并发现一个 Linux 内核零日漏洞，未发现客户数据被入侵的证据。Guillermo Rauch 称，一名白帽研究员借助 AI 智能体集群突破了全球多数云沙箱依赖的 Linux 虚拟化边界，公司已迅速保护客户并联合行业伙伴加固更广泛的互联网。他同时提到 OpenAI 的智能体逃逸事件属于“逃出网络”，即本不应联网的智能体通过入侵另一系统获得网络访问。
查看原帖We offered $1M to escape Vercel Sandbox. • 1,285 reports • $242,000 in bounties paid out • One Linux kernel zero day discovered • No reports of customer data compromise https://t.co/IWbHD6MNqJ
正文
当前显示原文，中文全文译文尚未就绪。
This is one of the most exhilarating times in technology, and this challenge was yet another jaw-dropping moment.
When the details of OpenAI’s agent escape and Hugging Face hack started to emerge, it became clear that agent containment would be one of the most important priorities for any AI infra company.
There are two classes of escapes: ① "escape the network" and ② “escape the matrix” 😁, as in, break the spell of virtualization. OpenAI was the former, where an agent not supposed to have internet access… gained it by hacking another system. Genuinely astonishing and worrisome.
Through this challenge, however, we discovered something even more groundbreaking. A talented white-hat researcher, armed with a swarm of AI agents, expertise and perseverance, "pierced through" the Linux virtualization boundary that nearly every cloud sandbox provider in the world banks on today.
I'm very thankful we got the report, were able to quickly move to protect our customers, found no evidence of customer data compromise, and collaborated with many industry partners to protect the wider internet.
Our confidence and conviction in Vercel Sandbox are even greater now, after some of the smartest, most motivated researchers in the world, and their agents, gave it their best shot.