Vercel published results of its two-week $1M HackerOne challenge against Vercel Sandbox, its Firecracker-microVM isolation for untrusted AI-agent code: 1,285 reports (877 duplicates, 57 valid), $242,000 paid, and no report showing access to customer data. The top finding, from Paulos Yibelo (pwn.ai) on day three, is an upstream Linux kernel networking-stack defect: crafted packets from inside a microVM can leak host memory (demonstrated against Vercel production), crash the host with two packets, and run commands as root on the host (shown on the researcher's matching KVM/Firecracker setup). Update Oct 15: the kernel bug is now public as CVE-2026-99999 ("PwnEscape", CVSS 9.3), fixed in stable kernels 5.10.272 / 5.15.223 / 6.1.190 / 6.6.159 / 6.12.113 / 6.18.57 / 7.2.11; see the News item. Vercel says almost every major cloud isolates workloads on the same kernel layer. A Vercel intern also found a device-mapper bug that let sandboxes read recycled disk blocks, and a researcher showed a guest-trusted snapshot record enabling cross-account restore. Trail of Bits' advice: never trust values from the guest, use one policy decider, and assume the next zero-day.