Web infrastructure provider Vercel has confirmed a security breach that allowed unauthorized access to parts of its internal systems, with the incident traced to a compromise involving Context.ai, a third-party AI productivity tool used by an employee.
The company issued its initial security bulletin on April 19, 2026, revealing that attackers gained entry by exploiting a compromised Google Workspace OAuth application associated with Context.ai. This access enabled the attacker to take control of a Vercel employee’s Google Workspace account and move into the company’s internal environment, where they were able to view and decrypt certain non-sensitive environment variables.
Security analysts describe the incident as a classic OAuth supply chain attack. Context.ai, a developer of AI evaluation and analytics tools, integrates its Office Suite application with Google Workspace through OAuth authentication. The breach originated from a Lumma Stealer malware infection on a Context.ai employee’s device in February 2026, which allowed attackers to harvest OAuth tokens in March and later use them to infiltrate Vercel’s systems.
According to security firm OX Security, the intrusion began when a Vercel employee installed the Context.ai browser extension and logged in using their enterprise Google account, granting extensive permissions. Vercel initially identified a limited number of customer accounts whose non-sensitive environment variables—such as API keys, tokens, database credentials, and signing keys—may have been exposed. The affected customers were notified immediately and instructed to rotate their credentials.
Further investigation revealed two additional concerns: a small number of extra accounts affected during the same incident and a separate group of customer accounts that showed signs of earlier compromise, possibly caused by social engineering or malware unrelated to the main attack.
Importantly, environment variables classified as “sensitive” remained protected, as they are stored in encrypted, non-readable formats that showed no evidence of unauthorized access.
Vercel CEO Guillermo Rauch stated that the attacker demonstrated advanced technical capabilities, citing their speed and familiarity with Vercel’s product APIs. A cybercriminal group operating under the alias ShinyHunters has reportedly claimed responsibility and attempted to sell stolen information—including internal databases, source code, and employee records—for $2 million on underground forums. Vercel noted that it has not received any ransom demand.
Working alongside GitHub, Microsoft, npm, and Socket, Vercel confirmed that none of its published npm packages were affected, and its software supply chain remains secure.
The company has urged customers to take several precautionary steps, including rotating all non-sensitive environment variables, enabling multi-factor authentication through authenticator apps or passkeys, marking future secrets as sensitive, reviewing activity logs for suspicious behavior, and auditing recent deployments to ensure proper security settings are enabled.
As part of the response, Vercel released an Indicator of Compromise (IOC)—an OAuth App Client ID—to help organizations identify potential exposure. Google Workspace administrators have been advised to check for activity involving the identified OAuth application, as the Context.ai compromise may have impacted numerous users across different organizations.
Vercel has engaged Google Mandiant and other cybersecurity partners to support the ongoing investigation and recovery efforts. The company also stated that it is implementing stronger default protections for environment variables and enhancing security monitoring tools to prevent similar incidents in the future.
Comments