After OpenAI reported that Hugging Face was hacked by AI agents powered by their models, people have (rightfully) raised cybersecurity and even existential worries. I'm not worried, and I want to explain why in terms everybody can understand.
If you are not up to speed, OpenAI described an agent was put inside an evaluation environment, or sandbox, for cybersecurity research purposes. It was instructed to try to escape it, and… it escaped. But it did so in a way that's surprising and deserves both credit and further study: it identified a novel security vulnerability.
At Vercel we let people run “untrusted code”, meaning code written by a potential adversary to our systems and those of our other customers', billions of times a week. And we help customers build and deploy these systems―all kinds of agents, websites and applications―millions of times a day.
And yet, in our 10 year history, even after AIs, LLMs and agents became commonplace, we've had zero instances of code running “escaping” and compromising other systems. Even now, when over 50% of the code deployed on our platforms comes from AI agents.
What are we escaping from?
In our modern world, “everything is computer”. Almost everything you interact with can run fairly arbitrary code. Your computer, obviously, runs code. Your browser runs the code X.com sends to show you posts and compose new ones. Computers in datacenters run code to process data, like returning the most recent timeline of posts to read.
Take the browser for example. Can the code X.com sends read your email? It cannot. If you're using Chrome, millions of expert human and AI hours have been spent on sandboxing the execution of the code. The code runs in a virtual machine: like a baby computer inside a larger computer.
What most people don't know is that virtual machines run the modern world. When you host an application on Vercel and you access it, we put code in a virtual machine, run it, and return the response to the end user. The code running inside cannot escape this sandbox. If it could, it would be catastrophic, which is why OpenAI and Hugging Face raised concerns.
These type of vulnerabilities, however, have existed, and are some of the most sought-after in the world by bad guys. When you “escape”, you can find data you're not supposed to access. If you break a browser sandbox, a website can access information of other websites you're logged into. In extreme cases, all files in your computer, and even trojan-horse them.