Next.js developer Vercel warns of customer credential compromise

Vercel disclosed an April 19 security incident involving unauthorized access to internal systems that led to credential compromise for a limited set of customers; the company recommended immediate credential rotation and is investigating potential data exfiltration. Context.ai later confirmed a March incident in which compromised OAuth tokens from its consumer AI Office product likely allowed an attacker to access Vercel’s Google Workspace after a Vercel employee granted broad permissions, illustrating risks from third-party integrations and agentic AI services.