Vercel Sandbox now runs Terminal-Bench and OSWorld evals

Vercel's Sandbox can now run Harbor, the evaluation harness behind Terminal-Bench. Its registry also covers SWE-bench, tau3-bench and OSWorld, per Vercel's changelog. Add --env vercel to a harbor run command and each trial gets its own Firecracker microVM instead of sharing one machine, so a batch of eval runs parallelizes past a single box. The integration requires Harbor 0.22.0 or later.

That parallelization matters for anyone running agent evals at scale, since queuing trials on one machine is the bottleneck Vercel is targeting here.

The security design is the bigger deal. Network policy gets enforced at the sandbox firewall, outside the VM the agent runs in. Optional credential injection attaches secrets to outbound requests without those secrets ever entering the sandbox, so the model never sees the token it's using.

Google's credentials API works the same way, and it's the right design for a simple reason. A prompt injection or a compromised tool call can't exfiltrate a credential it was never shown. The key exists only at the network layer, attached to the request after it leaves the sandbox. Most agent sandboxing still hands the model the key and hopes the isolation boundary holds. This design removes the need for that bet: the model has nothing to leak because it never held anything.

The changelog doesn't say how credential injection gets configured, or whether it's on by default or something teams opt into. Anyone running agents against real API keys should check that before assuming the protection applies automatically.