<h2>What happened</h2>
<p>In April 2026, Vercel confirmed a security breach that started well before anyone noticed. A Vercel employee had connected a third-party AI tool, <a href="http://Context.ai" target="_blank" rel="noopener nofollow">Context.ai</a>, to their corporate Google Workspace account via OAuth. <a href="http://Context.ai" target="_blank" rel="noopener nofollow">Context.ai</a> was itself compromised — first via an AWS breach in March, and earlier via a Lumma infostealer infection in February that lifted corporate credentials. Attackers used stored OAuth tokens from that compromise to pivot into the employee’s Vercel account, then worked their way deeper into internal systems.</p>
<p>The OAuth token was the key. It survived password rotations, bypassed perimeter defenses, and gave attackers the same permissions the employee had. From there, they enumerated environment variables not marked as “sensitive” — which Vercel did not encrypt at rest by default — and accessed a limited subset of customer credentials including API keys, GitHub tokens, npm tokens, and source code.</p>
<p>Vercel CEO Guillermo Rauch noted the attackers moved with unusual speed and precision, and suspects AI augmentation played a role. A threat actor claiming to be ShinyHunters posted on BreachForums offering to sell the stolen data for $2 million. The actual ShinyHunters group has denied involvement. Vercel confirmed no npm packages or open-source projects (Next.js, Turbopack) were compromised.</p>
<h2>The scope is wider than the initial disclosure</h2>
<p>Vercel’s investigation, which involved pulling and processing nearly a petabyte of logs, found evidence the attacker was active beyond the <a href="http://Context.ai" target="_blank" rel="noopener nofollow">Context.ai</a> compromise. Infostealer malware had been distributed more broadly to harvest tokens and API keys from multiple providers. Once attackers obtained those keys, the pattern was consistent: rapid API enumeration focused on non-sensitive environment variables.</p>
<p>Vercel has since notified other suspected victims of the same threat actor, independent of the Vercel incident, and is coordinating with Microsoft, AWS, Wiz, and Google Mandiant.</p>
<p><a href="http://Context.ai" target="_blank" rel="noopener nofollow">Context.ai</a> — whose staff was acqui-hired by OpenAI — acknowledged the breach may be broader than initially disclosed. Notably, Vercel learned about the <a href="http://Context.ai" target="_blank" rel="noopener nofollow">Context.ai</a> compromise from its own investigation rather than from <a href="http://Context.ai" target="_blank" rel="noopener nofollow">Context.ai</a> directly. As one observer put it, Vercel effectively acted as <a href="http://Context.ai" target="_blank" rel="noopener nofollow">Context.ai</a>’s security team.</p>
<h2>Why this attack worked</h2>
<p>The core problem is OAuth sprawl. When an employee connects a third-party app to their corporate account, that OAuth grant typically persists indefinitely. It doesn’t expire when the employee changes their password. It doesn’t get reviewed when the third-party vendor gets acquired or breached. It just sits there, live, waiting.</p>
<p>AI tools make this worse. They tend to request broad permissions — access to email, documents, calendars — because that’s what makes them useful. Shadow AI adoption (employees connecting tools without IT review) means security teams often have no visibility into which OAuth grants exist. The result is a growing attack surface that looks like legitimate user activity to traditional security tools built around network perimeters.</p>
<p>This isn’t a new attack pattern. It’s the same playbook used in the Codecov, CircleCI, Snowflake, and Okta breaches: compromise a trusted integration, inherit its permissions, move laterally. What’s changed is the volume of OAuth grants created by AI tool adoption and the speed at which attackers can exploit them.</p>
<h2>What Vercel is doing</h2>
<p>Vercel has shipped over 20 product improvements since the incident, including:</p>
<ul>
<li>An environment variables overview page in the dashboard</li>
<li>Improved UI for marking variables as sensitive</li>
<li>Easier MFA setup</li>
<li>Enhanced activity logs</li>
</ul>
<p>The company is working with Mandiant and law enforcement, and has directly contacted customers believed to be affected.</p>
<h2>What customers should do right now</h2>
<p>Vercel’s official guidance is to treat any non-sensitive environment variable as potentially exposed. Specific steps:</p>
<ol>
<li>Pull your environment variables locally using the Vercel CLI</li>
<li>Scan them with a tool like GitGuardian’s ggshield to identify which ones contain real secrets</li>
<li>Rotate any exposed credentials in upstream services (databases, APIs, etc.)</li>
<li>Enable the sensitive environment variable flag for anything that contains a secret going forward</li>
<li>Review activity logs for unusual access patterns</li>
<li>Audit recent deployments</li>
<li>Rotate deployment protection tokens</li>
</ol>
<h2>The broader problem</h2>
<p>This incident sits alongside a cluster of related SaaS security failures. Lovable, a vibe-coding platform, had a broken object-level authorization vulnerability that exposed user source code, database credentials, and AI chat histories to any free account holder — a bug reported 48 days before disclosure that was closed as a duplicate without escalation. Notion has a years-old vulnerability leaking editor email addresses from public pages, reported in 2022 and still unpatched.</p>
<p>The pattern across these incidents is consistent: AI startups move fast, security reviews are superficial or faked, and the OAuth connections those tools create become persistent attack vectors that nobody is watching.</p>
<p>The structural fix is treating OAuth grants the same way you’d treat a vendor relationship: inventory them, scope them to minimum necessary permissions, and revoke them when they’re no longer needed. Just-in-time access — where OAuth grants exist only during active approved sessions and expire automatically — is a stronger model than classifying secrets after the fact. Non-human identities like AI tools and MCP servers rarely get the same governance rigor as human accounts. That gap is exactly what attackers are exploiting.</p>


Collections

A Vercel security breach in April 2026 was traced to a compromised OAuth token from Context.ai, a third-party AI tool connected to a Vercel employee's Google Workspace account. Context.ai had been breached via an AWS compromise and an infostealer infection, allowing attackers to use persistent OAuth tokens to access Vercel's internal systems. Attackers enumerated non-sensitive environment variables — which Vercel did not encrypt at rest by default — and accessed customer API keys, GitHub tokens, npm tokens, and source code. The incident highlights the danger of OAuth sprawl, especially as AI tools request broad permissions and employees adopt them without IT review. Vercel has shipped over 20 product improvements and recommends customers rotate all credentials stored in non-sensitive environment variables. The broader pattern mirrors previous breaches (Codecov, CircleCI, Snowflake, Okta) and points to a structural gap in how OAuth grants and non-human identities are governed.

Vercel discloses security incident involving unauthorized internal access

<p>If you’re on Vercel - action this immediately</p>


<p>Let’s rotate that secret tokens A S A P</p>
