Vercel Asked Hackers to Break Its Sandbox. One Found a KVM Zero-Day.

Vercel offered hackers a reason to attack its sandbox. Now its boss says the programme has confirmed a previously unknown flaw in KVM, the Linux virtualisation technology used across the industry.

Guillermo Rauch credited security researcher Paulos Yibelo and said a full write-up is coming. Yibelo described an escape from a guest machine to host-level control.

Those are their disclosures; the technical report is not out yet. There is no basis here to declare every cloud compromised.

But the lesson is awkward for the agent boom: an AI's digital playground still needs walls. Paying people to check those walls looks rather sensible.