CONFIRMED INTRUSION
Vercel, April 2026: a small third-party AI tool became everyone's problem
An attacker compromised Context.ai, then used an employee's Google Workspace OAuth grant to reach Vercel's internal systems and decrypt non-sensitive environment variables.
What this was
Confirmed intrusion, disclosed by Vercel. The initial compromise was at a third party, not at Vercel, and the AI tool was the route in rather than the thing exploited. No model, agent or prompt was involved in the attack itself.
What happened
Vercel published an incident bulletin on 19 April 2026 and updated it over the following days. An attacker compromised Context.ai, a third-party AI tool, after a Context.ai employee was infected with the Lumma Stealer infostealer in February 2026, which harvests browser-stored credentials, session cookies and authentication tokens. The attacker used that access to take over a Vercel employee's Google Workspace account and then their Vercel account, and from there, in Vercel's own words, "maneuvered through systems to enumerate and decrypt non-sensitive environment variables". Vercel stated that variables designated sensitive and protected by encryption showed no evidence of unauthorized access, and that no npm packages published by Vercel were compromised. Customers were told to rotate non-sensitive environment variables as potentially exposed, enable multi-factor authentication, and enable the sensitive environment variables feature. The compromised Google Workspace OAuth app potentially affected hundreds of Context.ai users across many organizations.
Why an agent changes the risk
This is an OAuth and third-party risk story that happens to involve an AI tool, and that is precisely why it matters. AI tools are adopted the way this one was: by an individual, quickly, with a broad Workspace grant, below the threshold that triggers a vendor review. The grant outlives the evaluation. A tool nobody formally onboarded became a path into production infrastructure.
How to test for this
- Enumerate every OAuth grant against your identity provider and ask what each one can read. AI tools request broad scopes because they need context, which makes them unusually valuable to an attacker who compromises the vendor.
- Test the blast radius of one compromised employee session, including which third-party integrations that session can reach. The interesting question is not whether someone can be phished but what their grants reach afterwards.
- Separate secrets that are genuinely sensitive from those that are merely configuration, and test that the boundary holds. Vercel's encrypted variables survived this; the others did not.
Other cases
CONFIRMED INTRUSION
Hugging Face, July 2026: an autonomous agent ran the intrusion end to end
A malicious dataset chained two code-execution paths into node-level access and lateral movement across internal clusters, driven by an attacker framework that executed roughly 17,000 individual actions.
SUPPLY CHAIN COMPROMISE
LiteLLM, March 2026: a compromised scanner poisoned an AI gateway
TeamPCP compromised the Trivy CI pipeline, used that access to obtain LiteLLM's PyPI publishing tokens, and shipped a credential stealer in two releases of a package with roughly 95 million monthly downloads.
COORDINATED DISCLOSURE
Opening a repository was enough: pre-trust execution in a coding agent
A repository-controlled config file made a coding agent run attacker commands before its own trust dialog appeared, turning cloning a project into code execution.
CONTROLLED EVALUATION
OpenAI Operator: indirect prompt injection becomes an action risk
OpenAI’s published red-team work shows how untrusted content can influence a browser-using agent that can operate tools or move data.
CONTROLLED EVALUATION
Anthropic’s agentic-misalignment evaluation: model access can resemble an insider threat
Anthropic’s fictional corporate simulations test what can happen when a tool-using model has sensitive context, external actions, and a deliberately constructed goal conflict.
VENDOR-REPORTED DISRUPTION
Anthropic’s cybercrime disruption report: an agent can amplify a human attacker
Anthropic reported disrupting accounts that used Claude Code to assist a human-directed cybercrime operation, from reconnaissance through extortion support.
COORDINATED DISCLOSURE
nullifAI: malicious PyTorch models evaded pickle scanning on Hugging Face
Researchers found two Hugging Face-hosted model files with malicious pickle payloads that could reach web shells when loaded in an unsafe environment.