Vercel Discloses Breach Stemming from Third-Party AI Tool OAuth Compromise

How the breach unfolded

On April 19, 2026, Vercel confirmed unauthorized access to certain internal systems affecting a limited subset of customers. The breach originated from Context.ai, a small third-party AI tool that had been connected to a Vercel employee's Google Workspace account through OAuth permissions.

Attackers compromised Context.ai first, then used the OAuth tokens stored in that service to gain access to the Vercel employee's Google account. From there, they pivoted into Vercel's environment and accessed environment variables that were not marked as sensitive. Vercel stated that Next.js and Turbopack projects were not affected.

What was exposed

The attackers accessed environment variables that were not encrypted or marked as sensitive, potentially including API keys, authentication tokens, and database credentials. Vercel emphasized that variables explicitly marked as sensitive remained encrypted and showed no evidence of compromise.

A threat actor claiming affiliation with ShinyHunters posted data for sale on a cybercrime forum, though actual ShinyHunters members later denied involvement. Vercel contacted affected customers and instructed them to rotate credentials immediately.

The OAuth risk surface

Security researchers noted that the Vercel incident fits a broader pattern of supply chain attacks in early 2026 targeting developer-stored credentials across OAuth integrations and deployment platforms. AI productivity tools typically request broad permissions to be useful, including access to Google Workspace documents, email, and calendars.

When these tools are compromised, they can provide attackers with a comprehensive map of an organization's infrastructure and credentials. The attack surface is no longer just corporate perimeters but also the personal SaaS integrations of employees, most of which organizations do not inventory or monitor.