Cases › security breach › LR-2026-0487
Vercel breach via third-party AI tool Context.ai with broad Google Workspace OAuth access
Confirmed Why: GitGuardian research · GitGuardian · 3 independent reports
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: fix reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity major: test met: many third parties, since Vercel stated the broader compromise potentially affected hundreds of users across many organizations
Vercel, the cloud platform behind the Next.js framework, disclosed a security breach. The attack began at Context.ai, a third-party AI tool that a Vercel employee had connected to a corporate Google Workspace account with broad OAuth permissions. The attacker used that access to take over the employee's Vercel Google Workspace account and move into internal systems. Environment variables not marked sensitive were potentially exposed, while sensitive variables were reported as encrypted and not accessed. Vercel engaged Mandiant, notified law enforcement and contacted a limited subset of customers, who were advised to rotate credentials. A group claiming the ShinyHunters name took responsibility and is attempting to sell the stolen data. Investigations by both companies remain underway.
What happened
What was done
“Vercel has since rolled out new dashboard features, including an overview page for environment variables and an improved interface for managing sensitive variable settings.”
No later incident for Context.ai under this risk on record.
Risks
Read from the sources; not yet reviewed by a person.
Controls
ApplicationEffective Encryption of stored data
Control failure chain
L1 · ModelContext.aiModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Least-privilege access for the agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Multi-factor sign-in and password policy, Secrets scanning.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Encryption of stored data | L3 Application | Effective |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Separate identity for each agent | L3 Application | Not stated in sources |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Secrets kept out of the model's context | L3 Application | Not stated in sources |
| Activity logs | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
| Sensitive-data checks on outbound data | L3 Application | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Secrets scanning | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
- Cause a permission, scope or wiring error
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Show the full account: 3 items from the primary sources
What happened, in order
Not dated in the sources:
- The attacker took over a Vercel employee's Google Workspace account and moved laterally into internal systems.
- A group calling itself ShinyHunters claimed responsibility and attempted to sell the stolen data.
- Vercel rolled out new dashboard features for environment variables.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
No source states the date the breach occurred or the date of disclosure beyond the bulletin being published on a Sunday; source dates of 2026-04-20 are publication metadata, not stated facts, so no dates were entered. No autonomous AI agent acting on its own is described, so agent and failure fields were left out. No source states an employee training or access-review control, so none was recorded as missing.
LR-2026-0487 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON