Vercel has disclosed a security incident that began not on its own systems but inside a third-party AI tool one of its employees used. The cloud platform, widely used to host web applications, traced the intrusion to a compromise of Context.ai, whose access an attacker used to take over that employee's personal Google Workspace account.
From the Workspace account, the attacker reached the employee's Vercel account, then pivoted into a Vercel environment. Once inside, the intruder enumerated and decrypted a set of non-sensitive environment variables, the kind of stored configuration values that decrypt to plain text rather than staying encrypted at rest.
A limited subset of customers had their non-sensitive variables exposed, the company says, and it reached out to recommend an immediate credential rotation for that group. A broader review that followed, expanding the indicators of compromise under investigation and analyzing environment-variable read events across its logs, turned up a small number of additional compromised accounts, which the company also notified.
That same review surfaced a separate finding: a small number of customer accounts showed signs of compromise that did not appear to originate on Vercel's own systems and, the company says, do not look like a continuation of the Context.ai incident. Affected customers in that group received specific remediation guidance.
Working with Google Mandiant, other cybersecurity firms, industry peers and law enforcement, Vercel says it has engaged Context.ai directly to understand the scope of that company's own compromise. Separately, in collaboration with GitHub, Microsoft, npm and Socket, Vercel's security team confirmed that no npm packages it publishes were tampered with, and the company says its software supply chain remains intact.
An indicator of compromise the company published for the attack points to an OAuth application connected to Context.ai's own breach, one it says potentially affected hundreds of users across many organizations, not just Vercel's own staff. It urged Google Workspace administrators broadly, not only its customers, to check whether that application had been authorized in their environments.
To customers, Vercel recommends enabling multi-factor authentication, reviewing and rotating any environment variables not already marked as sensitive, and adopting its sensitive-variable feature so secret values cannot be read back later. It also advises reviewing account activity logs, checking recent deployments for anything unexpected and setting deployment protection to at least its standard level.
The chain of access is the notable part: a compromise inside a small, single-purpose AI tool, reached through one employee's individual account, became the entry point into a much larger cloud platform. Context.ai was not a core piece of Vercel's own infrastructure. It was a convenience tool with an OAuth connection to a Google Workspace account, and that connection turned out to be the weak link.
As archived, the dated update log on Vercel's bulletin for this incident runs from April 19 through April 24, with the company noting it was shifting to a less frequent, ad hoc cadence for any further updates and would post again if there is a material development to report.
Leave a Reply