Vercel AI Updates: October 15, 2026

1. Vercel Sandbox $1M Escape Challenge Surfaces a Linux Kernel Zero-Day

Vercel. Vercel published results from its $1M challenge to escape Vercel Sandbox, the Firecracker microVM service it offers for running untrusted and agent-generated code: 1,285 reports in two weeks, 57 valid (1 Critical, 5 High), $242,000 paid, and no reports showing customer data access. The critical finding was a Linux kernel networking zero-day where crafted packets from inside a microVM could leak host memory, crash the host, or run commands as root on matching KVM and Firecracker setups; patches and CVEs are pending. Other findings included cross-tenant reads of recycled device-mapper disk blocks and a snapshot restore flaw caused by the control plane trusting guest-supplied storage_url, size, and checksum metadata. Vercel says guest-to-control-plane values are now derived server-side or signed, snapshots are bound to their creating project, and nested virtualization is disabled, while a separate Trail of Bits review found the virtualization boundary sound. Source

2. NVIDIA Nemotron 3.5 Lightning Available Free on AI Gateway

Vercel. AI Gateway added NVIDIA’s Nemotron 3.5 Lightning as nvidia/nemotron-3.5-lightning-free at no cost, a hybrid Mamba-2 and mixture-of-experts model with 30B total and 3B active parameters and a 1M-token context window. It supports reasoning, tool calling, and structured outputs and is positioned for long-running agents, subagents, and RAG. The model is reachable through the AI SDK and the Chat Completions, Responses, and Messages APIs, but the provider may retain prompts for model improvement, and Vercel does not say how long free access will last. Source

3. AI SDK 7.0.140 Adds Configurable Tool Call Concurrency

Vercel. AI SDK ai@7.0.140 adds a toolCallConcurrency option to generateText, streamText, and ToolLoopAgent that caps how many SDK-executed tool calls run at once within a step. The default remains unlimited, a value of 1 runs calls sequentially in the order the model emitted them, and provider-executed tools are not affected. Queued calls do not start if the operation is aborted, and a streaming tool holds its slot until it returns final output or an error, which helps when tools hit rate-limited APIs or shared resources. Source