Vercel via an AI tool. The access path.
A stolen vendor OAuth token reached a workspace, then customer environment variables. A token with broad scopes is a finding. A token that reaches customer secrets is an attack path.
The record
Entry point. infostealer, Context.ai employee machine, around February 2026.
The identity in the middle. An OAuth token a Vercel employee granted to an AI tool, with mail, Drive and calendar scopes.
What was reached. env secrets, customer variables not marked as sensitive.
A stolen vendor OAuth token reached a workspace, then customer environment variables.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| infostealer | Entry | Context.ai employee machine, around February 2026 |
| vendor cloud | Step | Context.ai AWS, stored user OAuth tokens |
| oauth token | Step | granted by a Vercel employee to the AI tool |
| workspace | Step | mail, Drive and calendar, no password needed |
| internal | Step | escalation into Vercel systems, method not published |
| env secrets | Reached | customer variables not marked as sensitive |
Where a breakpoint would have been
The grant itself. It was standing access, approved once by one person, surviving password changes and appearing in no access review. Narrowing the scopes or expiring the grant closes the path at step three, before the vendor breach matters.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
6 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Trend Micro Research · Vercel security bulletin · Context.ai security update · OWASP Top 10 for Agentic Applications
Questions, answered.
The two questions this record answers.
What was the entry point in the Vercel via an AI tool incident?
The published path starts at infostealer, Context.ai employee machine, around February 2026.
What did it reach?
The last step in the published path is env secrets, customer variables not marked as sensitive.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.