← Back to feed

Vercel confirmed April 20 that it suffered a breach traced directly to a compromised third-party AI tool — Context.ai — used by one of its employees. The attack chain is now fully documented, and it is a precise illustration of how agentic AI tools that hold broad OAuth permissions create a new class of supply chain risk.

The Attack Chain

February 17: A Context.ai employee’s device is infected by Lumma information-stealing malware. The infostealer harvests credentials for Google Workspace, Supabase, Datadog, and Authkit, plus the support@context.ai account.

March: Using the stolen credentials, the attacker gains unauthorised access to Context.ai’s AWS environment. Context.ai brings in CrowdStrike, concludes the breach was limited to a single deprecated on-site product, and tells customers so.

April (weekend of April 19-20): Context.ai revises that conclusion. The attacker had also likely compromised OAuth tokens for some of its consumer users — and one of those tokens belonged to a Vercel employee who had signed up for Context.ai’s “AI Office Suite” using their Vercel enterprise account and granted “Allow All” permissions.

The attacker used the OAuth token in a replay attack to gain access to Vercel’s Google Workspace. From there, they moved into some Vercel internal environments and accessed environment variables not marked as “sensitive.” Vercel says all stored sensitive data is fully encrypted and does not appear to have been exposed.

Scope and Response

Vercel says the number of affected customers is “quite limited” — potentially hundreds. The company is notifying affected parties, has brought in Google’s Mandiant for investigation, and published an indicator of compromise: a malicious Google Workspace app whose presence should be checked immediately in Google Admin Console API Controls.

A group claiming to be ShinyHunters has taken responsibility. Cybersecurity firm Hudson Rock reported the same weekend that an actor began listing stolen “access key / source code / database” from Vercel on a cybercrime forum.

Context.ai says it has since implemented better encryption, segmentation, authentication, and monitoring controls across its primary AWS environment.

The Structural Problem

The vulnerability here is not a novel zero-day. It is the combination of three common enterprise behaviors:

1. An employee uses a personal-style AI productivity tool with a corporate SSO login
2. The OAuth grant is “Allow All,” which escalates to enterprise-wide Workspace permissions
3. The AI tool vendor holds live, replayable OAuth tokens without adequate revocation infrastructure

Austin Larsen, principal threat analyst for Google Threat Intelligence Group: “If your organization relies on their infrastructure, I strongly recommend you start looking into this immediately.”

The incident is the first widely documented case of a breach at a major developer platform that traces its initial vector to an agentic AI tool. As AI tool adoption inside enterprise environments accelerates — with tools that hold file access, email, calendar, and OAuth tokens — the supply chain surface is expanding faster than security teams are adapting.

Enterprise security teams should audit which AI productivity tools their employees are using with corporate OAuth grants, what permission scopes those grants include, and whether the tool vendor has token revocation infrastructure that actually works.