{"schema_version":"0.10.0","id":"LR-2026-0308","record_version":1,"title":"Vercel April 2026 security incident: breach via compromised Context.ai third-party AI tool","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.2,"score_breakdown":{"source_authority":16.5,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Register · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Register · subject to change"}]},"sources_hash":"79d4b263e207b3e16a1b619a98958a06857debed51ce5193dc593e540e9a0579"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-19","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Vercel reported unauthorized access to certain internal systems and said it was actively investigating with incident response experts. The incident began with a compromise of Context.ai, a third-party AI tool used by a Vercel employee. The attacker took over the employee's Google Workspace account, then the employee's Vercel account, and moved through systems to enumerate and decrypt non-sensitive environment variables. Vercel first identified a limited subset of affected customers, recommended credential rotation, and later found a small number of additional compromised accounts. Vercel said it had notified law enforcement. Its security team confirmed that no Vercel-published npm packages were compromised. The bulletin states that all remediation was complete and the incident was closed as of October 16, 2026. The sources do not state when the intrusion occurred or how it was first detected.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee.","primary_risk":"RK03","secondary_risks":["RK04"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate: data of others was touched (customer environment variables and additional customer accounts) with a bounded scope stated (a limited subset of customers and a small number of additional accounts).","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://vercel.com/kb/bulletin/vercel-april-2026-security-incident","publisher":"Vercel","date":"2026-04-19","type":"vendor_research","title":null,"archived_url":null,"attachment":"first_report"},{"url":"https://www.theregister.com/2026/04/20/vercel_context_ai_security_incident/","publisher":"The Register","date":"2026-04-20","type":"press","title":"Next.js developer Vercel warns customer creds compromised","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.precursor_events":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems."}],"event.precursor_events":[{"source_index":0,"quote":"The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee."}],"impact.severity":[{"source_index":0,"quote":"Initially we identified a limited subset of customers whose non-sensitive environment variables stored on Vercel (those that decrypt to plaintext) were compromised."}],"impact.severity_because":[{"source_index":0,"quote":"First, we have identified a small number of additional accounts that were compromised as part of this incident, and we have notified the affected customers."}],"event.summary":[{"source_index":0,"quote":"We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems."},{"source_index":0,"quote":"We are actively investigating, and we have engaged incident response experts to help investigate and remediate."},{"source_index":0,"quote":"The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee."},{"source_index":0,"quote":"The attacker used that access to take over the employee's individual Vercel Google Workspace account, which enabled them to gain access to that employee’s Vercel account."},{"source_index":0,"quote":"From there, they were able to pivot into a Vercel environment, and subsequently maneuvered through systems to enumerate and decrypt non-sensitive environment variables."},{"source_index":0,"quote":"Initially we identified a limited subset of customers whose non-sensitive environment variables stored on Vercel (those that decrypt to plaintext) were compromised."},{"source_index":0,"quote":"We have notified law enforcement and will update this page as the investigation progresses."},{"source_index":0,"quote":"In collaboration with GitHub, Microsoft, npm, and Socket, our security team has confirmed that no npm packages published by Vercel have been compromised."},{"source_index":0,"quote":"As of October 16, 2026 at 10:19 AM PST, all remediation actions related to the security incident are complete, and the incident is closed."}]},"notes_on_gaps":"Source 1 (The Register) contains only a site navigation listing with headlines and no article text about Vercel, so it was not used. The sources do not state the date the intrusion occurred, the date it was detected, or how it was detected, so those fields are omitted. No trigger is recorded: the sources name the Context.ai compromise but do not state the mechanism (the OAuth token wording comes from the incident title, not the source text). Judgements made: date_disclosed set to 2026-04-19 from the bulletin date; responsible_party third_party and root_cause integration reflect the Context.ai origin; adversarial_actor external_attacker is inferred from unauthorized access by an attacker; severity moderate follows the bounded scope stated. No stated count of affected parties, records, loss, or remediation hours exists, so those fields are omitted. The sources do not describe any autonomous AI agent, so agent fields and failure classes are omitted. No control was stated as held or missing in this incident, so only the failed environment-variable encryption is recorded. System model, developer, deployment context, industry and country are not stated and are omitted. Reversibility is not stated and is omitted. The April 20 and April 22 table entries contain links that break exact sentences, so they are not cited. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Register · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A third-party AI tool, Context.ai, was used by a Vercel employee and was compromised.","quote":"The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The attacker used access from the compromised tool to take over the employee's Google Workspace account and then the employee's Vercel account.","quote":"The attacker used that access to take over the employee's individual Vercel Google Workspace account, which enabled them to gain access to that employee’s Vercel account.","source_index":0,"grade":"C"},{"step":"reached","text":"The attacker moved into a Vercel environment and decrypted non-sensitive environment variables.","quote":"From there, they were able to pivot into a Vercel environment, and subsequently maneuvered through systems to enumerate and decrypt non-sensitive environment variables.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://vercel.com/kb/bulletin/vercel-april-2026-security-incident","https://www.theregister.com/2026/04/20/vercel_context_ai_security_incident/"]},"analysis":{"sections":{"timeline":[{"text":"Origin: compromise of Context.ai, a third-party AI tool used by a Vercel employee.","quote":"The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee.","source_index":0,"when":null},{"text":"Vercel notified law enforcement.","quote":"We have notified law enforcement and will update this page as the investigation progresses.","source_index":0,"when":null},{"text":"All remediation actions complete and the incident closed.","quote":"As of October 16, 2026 at 10:19 AM PST, all remediation actions related to the security incident are complete, and the incident is closed.","source_index":0,"when":"October 16, 10:19 AM PST"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://vercel.com/kb/bulletin/vercel-april-2026-security-incident","https://www.theregister.com/2026/04/20/vercel_context_ai_security_incident/"]}}