A compromised Context.ai OAuth token breached Vercel. Here's the checklist every security team should run through before the end of the day.
On April 19, Vercel disclosed a security incident involving unauthorized access to internal environments. The root cause: a compromised OAuth token from Context.ai, a third-party AI tool that one Vercel employee had connected to their enterprise Google Workspace account. That single point of consent, granted months earlier, was enough for the attacker to get in.
‍
The attack has been traced back to a Context.ai employee whose laptop was infected with Lumma infostealer in February 2026, reportedly after downloading Roblox cheat scripts. That single infection exfiltrated Google Workspace credentials, API keys, session cookies, and OAuth tokens. This allowed the attacker to access the secrets used to authorized OAuth calls on behalf of users of Context.ai across many organizations.
‍
One of those users was a Vercel employee who had signed up with their corporate Google account and approved broad scopes. Two months later, the attacker used that token to take over the employee's Google Workspace account, pivoted into Vercel using the OAuth client, pivoted to the cloud environment, and enumerated Vercel environment variables that weren't marked as “sensitive.” Vercel assesses the attacker as highly sophisticated and has engaged Mandiant, additional cybersecurity firms, and law enforcement.
‍
Environment variables marked sensitive in Vercel are stored in a way that prevents them from being read, and Vercel says it has no evidence those values were accessed. Non-sensitive variables that decrypt to plaintext are the ones at risk.
‍
The initial entry point for Vercel was through Context.ai. To ensure your organization is not similarly exposed, investigate any use of Context.ai by your employees.
‍
The OAuth app that was compromised has been deactivated by Context.ai. Search your Google Workspace for activity involving a grant with this client-id (as shared by Vercel):
‍
110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com
‍
Any account with activity related to this grant should be considered exposed.
‍
This breach didn't start at Vercel. It started at a vendor most security teams have never heard of, and it traveled through an OAuth grant one employee enabled months ago. That's the shape of modern supply-chain compromise: An infostealer hits a vendor you don't do business with, the attacker works backwards from stolen access, and an old consent becomes the front door.
‍
Use the next 24 hours to look past the Vercel-specific response and tighten a few things that matter for any breach shaped like this one:
Supply-chain compromises don't care whether you signed a contract with the vendor. If an employee granted a token, you're in scope.
‍
