The Vercel breach is not really about Vercel

Vercel disclosed a security incident this week. Unauthorized access to internal systems, environment variables exposed, a threat actor claiming to sell stolen data for $2 million. Mandiant is involved. Law enforcement has been notified.

The coverage has focused on Vercel. The more interesting part of this story is what got the attacker in: a small AI productivity tool that one employee signed up for using their work Google account.

That detail should make a lot of engineering teams uncomfortable. Not because they use Vercel. Because they almost certainly do the same thing.

What actually happened

The attack chain here is worth walking through carefully because it is not the kind of breach most teams are designing defenses against.

The npm packages are fine. Sensitive environment variables appear to be fine. But the path from "one employee signed up for a small AI tool" to "attacker inside enterprise infrastructure" took a few months and a handful of steps that each look mundane on their own.

The real problem is the AI tool sprawl

Most engineering teams right now have a mix of AI tools that employees adopted individually. Productivity tools, writing assistants, coding helpers, meeting summarizers. Most of them ask for Google OAuth on sign-up. Most employees click through.

Nobody has a complete inventory of which tools have which OAuth permissions across which accounts. Security teams are not reviewing these. IT is not provisioning them. They accumulate invisibly, each one a potential pivot point if the tool itself gets compromised upstream.

Context.ai is not a rogue product. It is a legitimate AI tool. The problem is not that the tool was malicious. The problem is that a compromised support account at a vendor with OAuth access to your enterprise environment is effectively a compromised account in your enterprise environment. The perimeter dissolved the moment the employee clicked "Allow All."

What you should do right now

If you are on Vercel, Vercel has been direct about the immediate steps. If you are not on Vercel, the broader lessons still apply.

The broader pattern

This attack is a clean example of a category of risk that is growing fast and that most organizations are not tracking well: third-party AI tool supply chain exposure.

A year ago, the primary supply chain concern was npm packages and open source dependencies. Those are still real. But the AI tool layer is new and it has a different risk profile. These tools are often adopted by individuals rather than IT, they ask for broad OAuth permissions as part of their core functionality, and they are connected to enterprise accounts rather than isolated developer environments.

The attacker who got into Vercel did not exploit a sophisticated zero-day in Vercel's infrastructure. They found a path through a vendor that had legitimate access, elevated through a support account compromise, and used OAuth permissions that an employee had granted months earlier without thinking twice about it.

That chain is reproducible. And most organizations have more links in it than they realize.