PLATFORMS Signal 465
A sandbox without a network boundary is only half a sandbox
↗
Vercel argues that compute isolation alone is insufficient for sandboxing untrusted code and has implemented a host-level network firewall to enforce egress controls on its microVM sandboxes.
As AI agents increasingly execute generated code, the network boundary becomes as critical as the VM boundary, a compromised agent doesn't need to escape its VM if it can simply exfiltrate data over the network. Engineers building systems that run untrusted or generated code need to treat DNS, proxies, and outbound connectivity as part of the security boundary, not optional add-ons.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
A microVM prevents access to the host but cannot stop contained code from exfiltrating data or attacking internal services through unrestricted network access.
Network bypasses, such as available DNS resolvers, fail-open allowlists, or trusted package registries used as relays, constitute sandbox escapes even when the VM boundary holds.
Vercel's sandbox firewall runs on the host outside the microVM, transparently redirecting outbound TCP and DNS traffic so that policies cannot be modified or disabled by code inside the sandbox.
THE CLUSTER