{"schema_version":"0.10.0","id":"LR-2026-0487","record_version":1,"title":"Vercel breach via third-party AI tool Context.ai with broad Google Workspace OAuth access","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":61.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.12,"unhedged_language":3.89},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"GitGuardian research","original_document":{"url":"https://blog.gitguardian.com/vercel-april-2026-incident-non-sensitive-environment-variables-need-investigation-too/","organisation":"GitGuardian","role":"researcher"},"reports_total":3,"reports_independent":3,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"GitGuardian research"}]},"sources_hash":"63245ee3e248964aa50c3f97b37e27db6b7f7b128f4ba7514069172237c13a5b"},"system":{"model_name":null,"model_version":null,"developer":"Context.ai","harness":null,"tools_granted":[],"permissions_scope":"Allow All OAuth permissions over the enterprise Google Workspace","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Enterprise AI platform that builds agents trained on company-specific knowledge","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-20","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Vercel, the cloud platform behind the Next.js framework, disclosed a security breach. The attack began at Context.ai, a third-party AI tool that a Vercel employee had connected to a corporate Google Workspace account with broad OAuth permissions. The attacker used that access to take over the employee's Vercel Google Workspace account and move into internal systems. Environment variables not marked sensitive were potentially exposed, while sensitive variables were reported as encrypted and not accessed. Vercel engaged Mandiant, notified law enforcement and contacted a limited subset of customers, who were advised to rotate credentials. A group claiming the ShinyHunters name took responsibility and is attempting to sell the stolen data. Investigations by both companies remain underway.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"integration","root_cause_detail":"Employee granted a third-party AI tool Allow All OAuth permissions over the enterprise Google Workspace","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK04"],"control_chain":[{"layer":"L3","party":"deployer","party_name":"Vercel","control_id":"H3","outcome":"held","reason":null,"quote":"The company said environment variables marked as \"sensitive\" are encrypted at rest and were not accessed, but that variables stored without that designation should be treated as potentially exposed.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["H3"],"quote":"Vercel has since rolled out new dashboard features, including an overview page for environment variables and an improved interface for managing sensitive variable settings.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test met: many third parties, since Vercel stated the broader compromise potentially affected hundreds of users across many organizations","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.tomshardware.com/tech-industry/cyber-security/vercel-breached-after-employee-grants-ai-tool-unrestricted-access-to-google-workspace","publisher":"Tom's Hardware","date":"2026-04-20","type":"press","title":"AI cloud company Vercel breached after employee grants AI tool unrestricted access to Google Workspace — hacker seeking $2 million for stolen data - Tom's Hardware","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cyberscoop.com/vercel-security-breach-third-party-attack-context-ai-lumma-stealer/","publisher":"CyberScoop","date":"2026-04-20","type":"press","title":"Vercel’s security breach started with malware disguised as Roblox cheats - CyberScoop","archived_url":null,"independence":"independent"},{"url":"https://blog.gitguardian.com/vercel-april-2026-incident-non-sensitive-environment-variables-need-investigation-too/","publisher":"GitGuardian Blog","date":"2026-04-20","type":"press","title":"Vercel April 2026 Incident: Non-Sensitive Environment Variables Need Investigation Too - GitGuardian Blog","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.adversarial_actor":"C","event.root_cause":"C","event.root_cause_detail":"C","system.developer":"C","system.intended_use":"C","system.permissions_scope":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Vercel, the cloud platform behind the widely used Next.js web framework, has acknowledged a security breach after an attacker compromised a third-party AI tool called Context.ai and used it to gain access to a Vercel employee's enterprise Google Workspace account."}],"event.adversarial_actor":[{"source_index":1,"quote":"An attacker traversed third-party systems and connections left exposed by employees before it hit the San Francisco-based company that created and maintains Next.js and other popular open-source libraries."}],"event.root_cause":[{"source_index":0,"quote":"Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace."}],"event.root_cause_detail":[{"source_index":0,"quote":"At least one Vercel employee had signed up for Context.ai's AI Office Suite using their corporate account and granted it \"Allow All\" OAuth permissions, Context.ai explained in its own security notice, which says that “Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.”"}],"system.developer":[{"source_index":0,"quote":"According to Vercel’s bulletin, the breach didn’t start with them but instead with Context.ai, an enterprise AI platform that builds agents trained on company-specific knowledge."}],"system.intended_use":[{"source_index":0,"quote":"According to Vercel’s bulletin, the breach didn’t start with them but instead with Context.ai, an enterprise AI platform that builds agents trained on company-specific knowledge."}],"system.permissions_scope":[{"source_index":0,"quote":"At least one Vercel employee had signed up for Context.ai's AI Office Suite using their corporate account and granted it \"Allow All\" OAuth permissions, Context.ai explained in its own security notice, which says that “Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.”"}],"impact.severity":[{"source_index":1,"quote":"Vercel also warned that the attack on Context’s Google Workspace OAuth app “was the subject of a broader compromise, potentially affecting its hundreds of users across many organizations.” It published indicators of compromise and encouraged customers to review activity logs, review and rotate variables containing secrets."}],"impact.severity_because":[{"source_index":1,"quote":"Vercel also warned that the attack on Context’s Google Workspace OAuth app “was the subject of a broader compromise, potentially affecting its hundreds of users across many organizations.” It published indicators of compromise and encouraged customers to review activity logs, review and rotate variables containing secrets."}],"event.control_chain":[{"source_index":0,"quote":"The company said environment variables marked as \"sensitive\" are encrypted at rest and were not accessed, but that variables stored without that designation should be treated as potentially exposed."}],"event.remediations":[{"source_index":0,"quote":"Vercel has since rolled out new dashboard features, including an overview page for environment variables and an improved interface for managing sensitive variable settings."}],"event.summary":[{"source_index":0,"quote":"Vercel, the cloud platform behind the widely used Next.js web framework, has acknowledged a security breach after an attacker compromised a third-party AI tool called Context.ai and used it to gain access to a Vercel employee's enterprise Google Workspace account."},{"source_index":0,"quote":"At least one Vercel employee had signed up for Context.ai's AI Office Suite using their corporate account and granted it \"Allow All\" OAuth permissions, Context.ai explained in its own security notice, which says that “Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.”"},{"source_index":0,"quote":"The attacker exploited that broad access to take over the employee's Vercel Google Workspace account and move laterally into internal systems."},{"source_index":0,"quote":"The company said environment variables marked as \"sensitive\" are encrypted at rest and were not accessed, but that variables stored without that designation should be treated as potentially exposed."},{"source_index":0,"quote":"Vercel said it has engaged Google-owned incident response firm Mandiant, notified law enforcement, and contacted a limited subset of affected customers directly."},{"source_index":1,"quote":"A threat group identifying itself as ShinyHunters took responsibility for the attack in a post on Telegram and is attempting to sell the stolen data, which they claim includes access keys, source code and databases."},{"source_index":1,"quote":"Context and Vercel said their separate and coordinated investigations into the attack aided by CrowdStrike and Mandiant remain underway."}]},"notes_on_gaps":"No source states the date the breach occurred or the date of disclosure beyond the bulletin being published on a Sunday; source dates of 2026-04-20 are publication metadata, not stated facts, so no dates were entered. No record counts, direct loss figures or durations are stated; the $2 million figure is a reported demand by the claimed attacker, not a loss, and was not entered as a value. The Hudson Rock account of Context.ai's infection is unconfirmed by Vercel at the time of writing and the threat actor's identity is disputed by a Google analyst. No autonomous AI agent acting on its own is described, so agent and failure fields were left out. Country was not stated and was not inferred from the San Francisco headquarters mention. Vercel's sensitive-variable dashboard changes were mapped to H3 as a judgement, since the sources do not name a control. No source states an employee training or access-review control, so none was recorded as missing. Severity major was chosen on the many-third-parties test using Vercel's stated hundreds of users across many organizations, which is a judgement about scope from a press-quoted bulletin. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (GitGuardian research)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An employee connected Context.ai's AI Office Suite to a corporate Google Workspace account and granted it Allow All OAuth permissions.","quote":"At least one Vercel employee had signed up for Context.ai's AI Office Suite using their corporate account and granted it \"Allow All\" OAuth permissions, Context.ai explained in its own security notice, which says that “Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.”","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The attacker used that broad access to take over the employee's Vercel Google Workspace account and move into internal systems.","quote":"The attacker exploited that broad access to take over the employee's Vercel Google Workspace account and move laterally into internal systems.","source_index":0,"grade":"C"},{"step":"reached","text":"Non-sensitive environment variables were exposed, and a group claiming the ShinyHunters name claimed responsibility for the attack.","quote":"The breach exposed non-sensitive environment variables, and a threat actor operating under the ShinyHunters name has claimed responsibility, reportedly seeking $2 million for the stolen data.","source_index":0,"grade":"C"},{"step":"done","text":"Vercel engaged Mandiant, notified law enforcement and contacted a limited subset of affected customers.","quote":"Vercel said it has engaged Google-owned incident response firm Mandiant, notified law enforcement, and contacted a limited subset of affected customers directly.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.tomshardware.com/tech-industry/cyber-security/vercel-breached-after-employee-grants-ai-tool-unrestricted-access-to-google-workspace","https://cyberscoop.com/vercel-security-breach-third-party-attack-context-ai-lumma-stealer/","https://blog.gitguardian.com/vercel-april-2026-incident-non-sensitive-environment-variables-need-investigation-too/"]},"analysis":{"sections":{"timeline":[{"text":"The attacker took over a Vercel employee's Google Workspace account and moved laterally into internal systems.","quote":"The attacker exploited that broad access to take over the employee's Vercel Google Workspace account and move laterally into internal systems.","source_index":0,"when":null},{"text":"A group calling itself ShinyHunters claimed responsibility and attempted to sell the stolen data.","quote":"A threat group identifying itself as ShinyHunters took responsibility for the attack in a post on Telegram and is attempting to sell the stolen data, which they claim includes access keys, source code and databases.","source_index":1,"when":null},{"text":"Vercel rolled out new dashboard features for environment variables.","quote":"Vercel has since rolled out new dashboard features, including an overview page for environment variables and an improved interface for managing sensitive variable settings.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.tomshardware.com/tech-industry/cyber-security/vercel-breached-after-employee-grants-ai-tool-unrestricted-access-to-google-workspace","https://cyberscoop.com/vercel-security-breach-third-party-attack-context-ai-lumma-stealer/","https://blog.gitguardian.com/vercel-april-2026-incident-non-sensitive-environment-variables-need-investigation-too/"]}}