Fifty thousand dollars for a guest-to-host escape

On 3 October 2026, security researcher Paulos Yibelo announced a “full VM escape zeroday,” describing it as “guest>host root in industry standard hypervisors.” Vercel chief executive Guillermo Rauch separately confirmed a KVM zero-day. “Affecting the industry's gold standard solution for Linux virtualization,” he wrote, and said a full technical write-up would follow. Neither statement described the exploit chain or named affected versions.

Yibelo's claim is that code inside a guest virtual machine gained root on the host running it. A guest is meant to stay separate from its host, and root is the highest level of control on a machine. The discovery came through the Vercel Sandbox bug bounty program.

Vercel's published architecture places each sandbox inside its own Firecracker microVM on a bare-metal Amazon EC2 host. The microVM has a dedicated guest kernel, and a Linux container inside the microVM runs the user's code. Vercel identifies the microVM, not the container, as the main security boundary.

That distinction matters for systems that run generated or downloaded code. Moving from a container into its guest operating system is not the same as reaching the host. Yibelo's claim describes the more serious crossing, in which the guest itself is left behind, although the technical steps remain undisclosed.

A bounty notification shared alongside the announcement shows Vercel awarding Yibelo $50,000, the program's maximum for a single report. The message describes the highest award as reserved for a vulnerability that lets an attacker read or change another Vercel customer's information, and its critical category includes microVM escapes to an EC2 host and access to another customer's data or code execution.

That award description should not be read as a public demonstration that customer data was stolen. The screenshot hides the report's root cause, and the available statements do not establish that real customer information was accessed.

The announcement identifies no CVE, no affected kernel releases, no processor requirements, and no patch, and it does not establish whether guest administrator access is required. Rauch's reference to KVM does not prove that every KVM deployment, Firecracker installation, or cloud provider is vulnerable. No exploitation in the wild has been shown, and the promised technical write-up has not yet appeared.

Vercel opened the program, run on HackerOne, on 18 August 2026 for two weeks, with a maximum of $50,000 per report and up to $1,000,000 in total. Its published rules required a live proof of concept that broke a security boundary rather than a report based only on reading code. The program closed on 1 September 2026, and the disclosure arrived a month later. Whether the confirmed KVM zero-day is that kind of crossing, or something narrower, is what the promised write-up would settle.