KVM guest-to-host escape zero-day found via Vercel bounty

A security researcher has claimed a full virtual machine escape zero-day in Linux KVM, the kernel-level hypervisor that underpins Vercel's Sandbox product for running AI agents, in a report made public on 6 October 2026. According to The Register, researcher Paulos Yibelo posted a screenshot on X of a bug bounty award, describing his find as a "Full VM escape zeroday (guest>host root in industry standard hypervisors)". Vercel chief executive Guillermo Rauch confirmed the report and named KVM as the affected hypervisor.

"We've confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry's gold standard solution for Linux virtualization," Rauch wrote, according to The Register.

Vercel sells MicroVMs as sandboxes for AI agents to work inside. Its Sandbox uses Firecracker MicroVMs, a technology created by AWS, which in turn relies on Linux KVM. That chain matters because the sandbox is the security boundary: if code running inside a guest VM can reach the host, the isolation that separates one customer's agent from another is gone.

The Register describes guest-to-host escapes as the nightmare virtualisation scenario, because whoever runs a guest VM could take over an entire server and perhaps gain the ability to control other guests on it. The outlet also notes how widely KVM is deployed. AWS and Google both use it to power their public clouds. Enterprise virtualisation vendors Nutanix, HPE and Proxmox also rely on it. Firecracker itself is open source and could therefore be running in many other places.

Beyond Rauch's confirmation and Yibelo's screenshot, no technical details are public. The Register said it could find no discussion on relevant mailing lists and has asked both Rauch and Yibelo for more information. The publication said it hopes not to hear back for days or weeks, so that a responsible disclosure process can run its course. Its reasoning is that even hints about the nature of the flaw could allow attackers to cause significant damage before a fix exists.

Once a patch is available, the open question is how disruptive deployment will be. The Register notes that it is possible to hot-patch KVM, and to migrate live VMs from vulnerable hosts onto machines running a patched kernel, and expresses hope that those techniques will work here. Neither approach has been confirmed as viable for this particular bug.

The Register says this may be the second serious KVM bug found this year, after the flaw known as Januscape. It also reports that observers have suggested the apparent seriousness of the issue means Yibelo's reward should exceed the $50,000 maximum available under Vercel's bug bounty programme. The amount actually paid has not been disclosed in public reporting.

For teams running AI agents in cloud sandboxes, the practical takeaway at this stage is limited, because there is nothing to patch and no indicator of compromise to look for. What the report does underline is that agent sandboxing inherits the security properties of the virtualisation stack beneath it. A MicroVM boundary is only as strong as the hypervisor enforcing it, and that hypervisor is shared by much of the public cloud. No evidence of exploitation in the wild has been reported.