al-ice.ai

Vercel Breach via Context.ai — Third-Party AI Tool OAuth Cascade

Security by al-ice.ai Editorial

AI relevance: A compromised third-party AI tool (Context.ai) became the entry point for a breach that cascaded through OAuth token chains into Vercel's internal systems, demonstrating how AI SaaS integrations with broad permissions create cross-organizational attack paths.

What happened

Vercel disclosed a security incident in April 2026 that originated at Context.ai, a third-party AI tool used by one of Vercel's employees. The attack chain unfolded across multiple organizations:

  • February 2026 — A Context.ai employee's computer was infected with Lumma Stealer malware after searching for Roblox game exploits, a common infostealer deployment vector (confirmed by Hudson Rock).
  • The stealer captured a Google Workspace OAuth token belonging to a Vercel employee who had granted Context.ai full access to their account.
  • The attacker used the OAuth token to take over the employee's Vercel Google Workspace account, then pivoted into Vercel's internal environments.
  • Inside Vercel, the attacker enumerated and decrypted non-sensitive environment variables — those not marked as "sensitive" in Vercel's system — exposing a limited set of customer-related data.
  • A threat group calling itself ShinyHunters claimed responsibility and attempted to sell stolen data on Telegram, though Google's Threat Intelligence Group assesses the claim as likely impersonation.

Vercel CEO Guillermo Rauch characterized the attackers as "highly sophisticated" and stated he "strongly suspect[s] they were significantly accelerated by AI", noting their rapid movement and deep understanding of Vercel's product API surface.

Why it matters

  • AI tool supply-chain risk is cross-organizational. Vercel was not a Context.ai customer — the breach path went through an individual employee's personal use of the AI tool, showing how AI SaaS adoption creates indirect trust relationships that bypass traditional vendor-risk assessments.
  • OAuth scopes are the weak link. The employee had granted Context.ai full Google Workspace access, and Context.ai itself held OAuth tokens for hundreds of users across many organizations. A single infostealer infection at one vendor cascaded into another company's internal systems.
  • AI acceleration of attacks. Vercel's own assessment that attackers were AI-accelerated highlights a growing pattern: threat actors using LLMs to understand product APIs, enumerate systems, and move laterally at speed.
  • "Non-sensitive" is still sensitive. Environment variables not flagged as sensitive were still readable and included customer-facing credentials. The distinction between sensitive and non-sensitive only matters if classification is exhaustive — and it rarely is.

What to do

  • Google Workspace admins: Check for and revoke the suspicious OAuth app ID 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com if present in your tenant.
  • Audit OAuth grants to AI tools. Review which third-party AI services have broad OAuth scopes to your organization's identity provider. Prefer least-privilege scopes and periodic grant reviews.
  • Mark all secrets as sensitive. If your platform distinguishes sensitive from non-sensitive environment variables, treat everything containing credentials as sensitive by default.
  • Rotate exposed variables. Vercel customers should review deployment logs, rotate any environment variables containing tokens or API keys, and enable 2FA on all accounts.

Sources