Vercel Breached Through Compromised AI Workplace Tool — ShinyHunters Claims $2M Ransom
Attackers exploited an over-permissioned employee AI tool (Context.ai) to pivot into Vercel's internal systems via OAuth. 580 employee records exposed. Next.js and Turbopack are unaffected.
Vercel confirmed a security breach on April 19, tracing the intrusion to a compromised third-party AI tool used internally by employees. The attack vector was Context.ai, a workplace AI platform that had been granted broad Google Workspace OAuth access. Attackers compromised a Context.ai employee credential, escalated through its OAuth permissions, and pivoted into Vercel’s internal systems.
The confirmed exposure covers 580 Vercel employee records — names, email addresses, account status flags, and activity timestamps. Possible additional exposure includes internal environment variable data, which could contain API keys and GitHub tokens scoped to Vercel’s own infrastructure. Vercel has not confirmed the full extent of secondary data exposure. An incident response firm is engaged and law enforcement has been notified.
ShinyHunters, the threat actor behind the 2024 Snowflake breach and this year’s Rockstar Games incident, is claiming credit. The group posted data samples to BreachForums and is demanding a $2 million ransom. Vercel has not confirmed whether a ransom demand was received or whether any negotiation has occurred.
Vercel’s public statement confirmed the two things that matter most to its developer user base: Next.js and Turbopack are unaffected, and customer-deployed applications are not at risk from this incident. The breach is scoped to Vercel’s internal employee directory and tooling — not to its hosting platform or customer environments.
The attack pattern should concern everyone building with AI workplace tools. Context.ai was granted Google Workspace OAuth access — a standard integration for tools that need to read emails, calendars, and documents. Broad OAuth grants in SaaS environments represent a supply-chain attack surface that doesn’t appear in traditional vulnerability scans or dependency audits.
This is structurally identical to how attackers compromised Snowflake in 2024: they didn’t break Snowflake’s product. They accessed credentials through a third-party tool that had been granted excessive permissions to customer environments. The difference here is that Vercel is the victim, not the platform being weaponized to attack downstream customers.
Two immediate actions for any team running AI workplace tools:
1. Audit OAuth grants now. In Google Workspace: Admin Console → Security → API Controls → App Access Control. In Microsoft 365: Azure AD → Enterprise Applications → filter by OAuth 2.0 consent. Remove or downscope anything you don’t recognize or no longer use.
2. Enforce least-privilege scopes. Most AI tools request read-all access at install time and never get re-reviewed. If a tool only needs to read specific calendars, it shouldn’t have access to your full user directory, Drive, or Gmail. Revoke over-permissioned grants and require narrower scopes on re-authorization.
Vercel has revoked Context.ai’s OAuth access and removed it from its internal tooling environment. Investigation is ongoing. No timeline has been given for a full post-incident disclosure.