Tracekit Box runs AI agent jobs in networkless Firecracker micro-VMs
Host doors sign commands, connections, secrets, model calls and patches into one offline-verifiable .tkb bundle.
52
Product
Firecracker
- Mentions · 7d2
- Mentions · 30d13
- All mentions16
- First seenSep 8, 2026
- Last mentioned2d ago
Timeline
16 articles · newest firstRunbook hardens shared Linux hosts against cache covert channels
The guide covers KVM, Firecracker and QEMU: separate cores, disable KSM, keep CPU mitigations, and partition L3 with resctrl.
42
Linux networking flaw lets KVM guests escape to the host
Pwn.ai leaked host memory on Vercel production sandboxes and gained root on lab hosts; guest-only updates do not fix it.
84
Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents
Perplexity open-sourced SPACE, a Firecracker microVM sandbox for isolating AI agents.
55
Linux kernel gets a fix for a flaw that enabled attackers to escape VMs
Linux patched CVE-2026-99999, a networking flaw researchers used to escape VMs to the host.
80
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
Linux kernel flaw CVE-2026-99999 lets guest VMs read host memory, shown on Vercel sandboxes but not exploited in the wild.
82
AWS Bedrock AgentCore Flaw Allowed Attackers to Hijack AI Agents Using a Single Prompt
Zenity showed one prompt could steal Bedrock AgentCore credentials and reach other agents in the account.
75
One Prompt Could Hijack AWS AI Agents and Steal Cloud Credentials
Zenity's AgentCorruption chain let one prompt expose Bedrock AgentCore chats, memories, and cloud secrets.
73
AWS AgentCore security undone by prompt requesting credentials
Zenity Labs showed one prompt could steal AWS AgentCore IMDS credentials and hijack regional agents.
76
Security researcher claims to they found KVM guest-host escape flaw
Researcher claims a KVM guest-to-host escape zero-day; Vercel confirmed it, but no details are public.
72
Security researcher claims they found KVM guest-host escape flaw
Paulos Yibelo claims a KVM guest-to-host root escape zero-day found via Vercel’s Firecracker sandbox bounty.
78
Re: cloud computing provider disclosures
oss-security reply says Xen, KVM, QEMU, and Cloud Hypervisor already have separate disclosure processes.
22
Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000
Vercel confirmed researcher Paulos Yibelo's KVM zero-day guest-to-host root escape and paid a $50,000 bounty.
74
Containers Are No Longer a Security Boundary
DepthFirst showed CVE-2026-80521, a Linux AF_UNIX use-after-free, can escape containers sharing the host kernel.
66
Cloudflare Containers Vulnerability Could Leak Data Between Customer Workloads
Cloudflare patched a Containers flaw that could let one tenant read residual disk data from another.
74
The VMs Powering Mobile Agents (Instinct, Claude Code)
A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.
35
Related CVEs
by mentions- CVE-2026-99999<1%9.3Linux kernel IPv4 checksum metadata can corrupt headers
- CVE-2026-80521<1%7.8Linux kernel: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially
Appears with
- Vercelorganization · 6
- Linux kernelproduct · 5
- KVMproduct · 5
- Amazon Web Servicesvendor · 4
- Vercel Sandboxproduct · 4
- Amazon Elastic Container Registryproduct · 3
- pwn.aiorganization · 3
- Amazon Web Servicesorganization · 3
- AWS Secrets Managerproduct · 3
- Amazon Bedrock AgentCoreproduct · 3
- AWSvendor · 3
- QEMUproduct · 2
- Zenity Labsorganization · 2
- Proxmoxorganization · 2
- Googleorganization · 2
- HPEorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.