Vercel breached via compromised third-party AI tool

Vercel suffered a security breach after a third-party AI tool's Google Workspace OAuth app (linked to Context.ai) was compromised, allowing an attacker to take over a Vercel employee account and access some internal environments and environment variables not marked as sensitive; affected customers were notified and advised to rotate credentials and review activity logs. Vercel engaged external incident responders (including Mandiant/Google) and implemented additional protections while investigating supply-chain exposure and potential wider impact; a claim of data sale appeared on BreachForums but was later disavowed by the original group.