Octagon Networks @OctagonNetworks

A lot of speculation on if KVM bugs have gotten cheaper, and why id do it for 50k instead of a milly. I wasn't born yesterday. I know I couldve sold it for waayy more. I didnt want to. I did it for the love of the game. I wanted to know if I could do it, and now we know i can. Maybe I am a big dreamer?

Vercel is the best security team we have worked with. The entire management chain is hyper paranoid and wonderful to work with! We will release more on these container escapes once the patches land! Stay tuned!

Guillermo Rauch @rauchg

a week ago

We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization. 2026 is wild! Thankful to Paulos and other researchers helping us make the most secure sandbox for agents. Full writeup coming.

107 150 2K 248K 532

Containers don't contain, but VMs don't contain either :-)

Paulos Yibelo @PaulosYibelo

a week ago

Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon

135 218 3K 562K 666

@S1r1u5_ We think the operators intution is still everything that decides quality. Seems like a very rare combo

KVM has a zero day in it. That's the hypervisor underneath nearly every AI agent sandbox on the market, found through Vercel's own bug bounty program. Paulos Yibelo reported a full VM escape, guest to host root, in what Guillermo Rauch called the industry's gold standard for Linux virtualization. The specific finding that paid out at the program's $50,000 critical tier was a cross-tenant read, modify, and remote code execution path from microVM to host. That's not a Vercel bug. That's a bug in the thing underneath Vercel, and underneath most of its competitors too. Worth sitting with the market this sits inside. E2B is valued around $104 million, Daytona just raised a $24 million Series A at roughly $125 million, and Modal is reportedly in talks to raise $750 million at a $16 billion valuation, triple what it was in May, on revenue that went from $60 million to $300 million in eight months after launching over a billion sandbox instances. Everyone in this category competes on cold start time and price per vCPU hour. A recent benchmark put Vercel at 0.67 seconds median time to interactive against Daytona's 0.27, though Daytona's success rate under burst load was only 37%, which tells you a median alone doesn't mean much. Per thousand executions under a realistic idle heavy agent pattern, Northflank priced out near $11 and Modal near $40. Here's what none of that pricing table captures. E2B and Vercel resolve a conflicting allow list and deny list in opposite directions, so the same IP rule produces a different security outcome depending on which provider you picked for the speed numbers. Almost nobody shops for a sandbox on that detail, until an agent running untrusted code all day finds the one network path or kernel path the model didn't account for. That's exactly what happened here. The whole category sells isolation as a commodity feature with a price tag attached. A $50,000 bounty payout is a reminder that the isolation is a shared, rented foundation with one landlord, the Linux kernel, and every tenant's security posture is only as good as how hard that landlord has actually been tested. x.com/rauchg/status/…

Guillermo Rauch @rauchg

a week ago

We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization. 2026 is wild! Thankful to Paulos and other researchers helping us make the most secure sandbox for agents. Full writeup coming.

107 150 2K 248K 532

btw, this is quite huge. there is no sandbox from any provider today that i would treat as unescapable by a sufficiently capable adversarial agent. containers fell. kvm fell. sandboxing is hard!!!

Paulos Yibelo @PaulosYibelo

a week ago

Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon

135 218 3K 562K 666

.@DarioAmodei and @sama! it is high time you put some money into KYC, or whatever trust/verification system you want, and give legitimate security researchers access to your best models. 1. we’ve helped secure both of your companies multiple times against issues that could have had serious consequences. i wouldn’t be surprised if we can keep doing that, and i also wouldn’t assume every capable attacker is reporting what they find. 2. there is now a KVM escape that, if researchers hadn’t found it first, could have been exactly the kind of thing your models eventually find in another hugging face style incident. you know, the list will keep growing, this is not the end. it rationally makes sense to get as many trusted researchers and companies as possible red teaming your companies, your models, and the infrastructure they depend on.

Nice. This year is the year of the VM escape. But I read the kvm ML and tree daily, and nothing in the recent public kvm patches looks like a microvm escape. Probably not "kvm" but another virt stack. Maybe I missed it, or a stealth merge is coming. Curious either way.

Guillermo Rauch @rauchg

a week ago

We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization. 2026 is wild! Thankful to Paulos and other researchers helping us make the most secure sandbox for agents. Full writeup coming.

107 150 2K 248K 532

Guest-host escapes are the nightmare virtualization scenario. If true, observers have suggested the potential seriousness of the flaw means this researcher's reward should be more than the $50k max under the bug bounty program. Read more here: theregister.com/offbeat/2026/1…

Type of hunters you see at the BBP after you announce a $1m bounty

Absolute madness of a finding and justice for Paulos because the bounty is a tiny fraction of what he deserves. Congrats buddy!

Paulos Yibelo @PaulosYibelo

a week ago

Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon

135 218 3K 562K 666

Wait. Look at @rauchg avatar. Is he fondling @PaulosYibelo??!?!

TechFollow @TechFollowrazzi

a week ago

🗞️ @rauchg followed @PaulosYibelo @PaulosYibelo reported a virtual-machine escape this week, with @vercel confirming a KVM zero-day through its sandbox bounty program and a full write-up still to come.

1 3 19 9K 6

Sandboxing is more important than ever. Exactly why we put a $200k bounty on a Firecracker/gVisor escape on ZeroDay.Cloud/2026

Guillermo Rauch @rauchg

a week ago

We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization. 2026 is wild! Thankful to Paulos and other researchers helping us make the most secure sandbox for agents. Full writeup coming.

107 150 2K 248K 532

next-level detection & response 😅 > half-jokingly suggested trying to rediscover the bug > set up the environment, started an agent with a cyber model, gave it one clue partway through (not saying what it was until the patch is out :))) > ~2 hours later: found the bug and validated an end-to-end exploit* > …** hats off to @PaulosYibelo for the original discovery… incredible work! definitely not an easy bug to find, especially without “cheating” :D * x.com/0x4d31/status/… ** x.com/zbraniecki/sta…

Adel Ka @0x4D31

a week ago

i probably won’t sleep until i rediscover this with my agent :)) and i’m not even a vuln researcher…!

5 0 45 16K 11

Funnily enough, I broadly agree with Mr. @DeGatchi. For vulnerabilities like this one which impacts everybody using KVM (read every hyperscaler, every AI lab, every company on the planet really), there should be a fund that pays from all of them. As Vercel we are trying to do our part here. And all credit to @PaulosYibelo for going down the pass of responsible disclosure!

This is a great idea, and I hope it applies

Malte Ubl @cramforce

a week ago

Funnily enough, I broadly agree with Mr. @DeGatchi. For vulnerabilities like this one which impacts everybody using KVM (read every hyperscaler, every AI lab, every company on the planet really), there should be a fund that pays from all of them. As Vercel we are trying to do

18 21 285 40K 45

This idea could geniuley transform bug bounty and really align incentives of most researchers and hackers, as well as help the internet find the nastiest bugs really quickly. This is a top tier CTO comment and if done, I have no doubt it would start a security revolution! So many talented hackers don't even look bc reporting etc is just a mess, or often just unrecognized so god knows what's buried in random dependacies of the everyday tools we use. 1000% agree

Malte Ubl @cramforce

a week ago

Funnily enough, I broadly agree with Mr. @DeGatchi. For vulnerabilities like this one which impacts everybody using KVM (read every hyperscaler, every AI lab, every company on the planet really), there should be a fund that pays from all of them. As Vercel we are trying to do

18 21 285 40K 45