A Hacked AI Tool Let Attackers Into Vercel for Months

A security incident at Vercel, the popular web development platform, traces back to a compromised AI tool that one of its employees used in their daily work. The sequence of events, now confirmed by both companies, gives a detailed look at how AI tool integrations are creating new attack paths across the developer ecosystem.

It started with a Roblox game cheat script. In approximately February 2026, an employee at Context.ai, a third-party AI analytics tool, downloaded what turned out to be malware, specifically a type known as Lumma Stealer, according to TechCrunch. That malware gave an attacker access to the employee's credentials, which opened the door to Context.ai's AWS environment, where OAuth tokens for the tool's users were stored.

How the attack reached Vercel

One of Context.ai's users was also a Vercel employee. Using the stolen OAuth token for that account, the attacker accessed the employee's Vercel workspace and moved laterally through Vercel's systems. Vercel confirmed that non-sensitive environment variables stored on its platform were accessed and decrypted. The attacker associated with the ShinyHunters persona subsequently claimed responsibility and was reportedly offering the stolen data for $2 million.

Vercel is working with Google Mandiant and law enforcement. In collaboration with GitHub, Microsoft, npm, and Socket, the company has confirmed that no npm packages were compromised. Additional affected accounts have since been identified in the ongoing investigation.

The supply chain problem

What makes this incident worth paying attention to is less the breach itself and more the path the attacker took to get there. The vulnerability was not in Vercel. It was in a tool that one of Vercel's employees chose to use, which happened to store OAuth tokens in a way that let an attacker use them as skeleton keys.

This is what AI tool supply chain attacks look like in practice. As developers and teams adopt AI tools for analytics, code review, documentation, and other workflows, each integration creates a new trust relationship. That tool now has some form of access to systems the team uses. If the tool's security is weaker than the team's, the team inherits that weakness.

Context.ai's breach did not start with a sophisticated exploit. It started with gaming-forum malware targeting a single employee's machine. The reach of that event extended, through a chain of OAuth connections, to a major development platform and its customers. The gap between entry point and final target was one employee's side hobby.

What this means for developers

The practical implication is uncomfortable. Evaluating the security posture of every AI tool you integrate with is now part of operating responsibly. That includes how OAuth tokens are stored, what data the tool can access, whether tokens are properly scoped, and how quickly a vendor can revoke access if they detect a problem. Most teams do not currently conduct this kind of review for productivity tools, and AI tools have not historically been treated as a meaningful security surface.

That is probably the more lasting lesson here: the distinction between "AI tool I added to my workflow" and "third party with privileged access to my systems" is a distinction worth making explicitly.