The 2026 Vercel breach did not start with a bug in Vercel. It started with an OAuth token that a Vercel employee had granted to an AI analytics tool. From that token the attacker walked a chain of access steps to customer secrets, and each step on its own looked like normal, authorized activity. The chain was the problem.
TL;DR
- Per Trend Micro, the intrusion began around February 2026 with a Lumma Stealer infection at Context.ai, a company that makes AI analytics tooling.
- The attacker took OAuth tokens that users had granted to Context.ai, including one for a Vercel employee's Google Workspace account.
- From that account the attacker moved into Vercel's internal systems and read customer environment variables that were not marked as sensitive. Vercel disclosed the incident on 19 April 2026 and described the impact as limited.
- No single step was a vulnerability. The question that would have caught it is: from this AI tool's token, what can an attacker eventually reach?
#What happened
Trend Micro's research team reconstructed the attack chain from Vercel's security bulletin, Context.ai's own update and statements by Vercel's CEO. According to that reconstruction, a Context.ai employee's machine was infected with Lumma Stealer, an infostealer, around February 2026. The stolen credentials gave the attacker access to Context.ai's AWS environment, where OAuth tokens belonging to users of the product were stored.
One of those tokens belonged to a Vercel employee's Google Workspace account. From there the attacker escalated into Vercel's internal systems. Vercel's CEO described this as a series of maneuvers; the exact technique has not been published. With internal access, the attacker enumerated customer environment variables that had not been flagged as sensitive.
Trend Micro puts the time from first infection to disclosure at roughly two months. It also notes a single public customer report of a leaked-key notification on 10 April, nine days before the disclosure. That is one report, not a forensic finding, and Trend Micro treats it that way.
#The attack path, step by step
# as publicly described by Vercel, Context.ai and Trend Micro infostealer # Context.ai employee machine, around February 2026 → vendor cloud # Context.ai AWS, stored user OAuth tokens → oauth token # granted by a Vercel employee to the AI tool → workspace # mail, Drive and calendar, no password needed → internal # escalation into Vercel systems, method not published → env secrets # customer variables not marked as sensitive
The last step matters most for customers. Environment variables usually hold database URLs, cloud keys and API keys. Each of those is the start of a new path into a different system with its own reach.
#Why every step looked normal
| Step | What a single-point control sees |
|---|---|
| OAuth grant to an AI tool | An approved app with a valid token |
| Token used from the vendor side | An authorized application calling an API |
| Workspace account active | A real employee account, no password change, no MFA prompt |
| Internal system access | A trusted identity signing in to internal tools |
| Environment variables read | A platform feature working as configured |
OAuth tokens do not need the user's password, they survive password changes and they are rarely reviewed after the first approval. Every step here used access that had been granted on purpose. The risk only becomes visible when the steps are connected. A token with broad scopes is a finding. A token from which an attacker can walk to customer secrets is an attack path.
#Where the path could have been broken
Breaking the chain at one point is enough. For this incident there were at least four breakpoints.
The OAuth grant. Treat every grant to a third-party AI tool like a vendor with standing access. Limit scopes to what the tool needs, review grants on a schedule and revoke apps nobody has used for 90 days.
The trust between a mailbox and internal systems. A collaboration account should not be one step away from systems that expose customer secrets. Separate the identity used for mail and documents from the identity used for production access, and require step-up authentication for the second one.
The default for secrets. Per Trend Micro, Vercel's sensitive flag for environment variables was off by default at the time. Any control that needs an opt-in for every single secret will be skipped in practice. A dedicated secrets manager with runtime injection removes that choice.
Long-lived credentials downstream. Static database passwords and cloud keys turn one exposed variable into a new entry point. Short-lived, workload-based credentials cut the path after the last step.
#What this means for AI agents
This case involved an AI analytics tool, not an autonomous agent. The pattern is the same, and agents make it sharper. When an employee connects an AI tool or an agent to Google Workspace, Microsoft 365, GitHub, Slack or Salesforce, the tool gets its own token with its own scope and lifetime. It is a non-human identity. It often has no named owner and broader scopes than the person who approved it realised, and an agent chains tools and credentials on its own.
The OWASP Top 10 for Agentic Applications lists this as ASI03, Identity and Privilege Abuse: whoever takes over or tricks an agent inherits every identity it holds. The Vercel chain shows what that inheritance looks like in practice, one step at a time. We saw the same shape in the Salesloft Drift OAuth breach, where a SaaS integration's tokens led to Salesforce data.
#What to check this week
- Count the AI tools holding OAuth tokens into your tenant. Google Workspace: Admin Console, Security, API controls, third-party app access. Microsoft Entra: Enterprise applications and user consents.
- Find the grants with mail, Drive or admin scopes. Those are the ones that turn a vendor breach into an account takeover.
- Give every grant a named human owner. A grant nobody owns is a grant nobody will revoke.
- Check which accounts that granted tokens can also reach production. That overlap is where a mailbox becomes an entry point.
- Rotate secrets stored as plain environment variables, then redeploy. Trend Micro notes that older deployments keep using the old value until they are redeployed.
- Ask the one question most teams cannot answer. If one of these vendors is breached tomorrow, how many steps is the attacker from your customer data?
On Elmoz
#FAQ
How did the Vercel breach start?
It started outside Vercel. Per Trend Micro, an employee of Context.ai, an AI analytics tool, was infected with Lumma Stealer around February 2026. The attacker reached Context.ai's AWS environment and took OAuth tokens that users had granted to the tool, including a Google Workspace token belonging to a Vercel employee.
What is an attack path?
An attack path is the chain of access steps an attacker can take from an entry point to a valuable target, such as production systems or sensitive data. Each step on its own can look legitimate. The risk comes from the chain, not from any single step.
Why did security controls not catch the OAuth token abuse?
OAuth tokens do not need the user's password, survive password changes and usually do not trigger MFA. The attacker used a token that had been legitimately granted, so each step looked like normal activity by an authorized application or user.
Are AI tools with OAuth access non-human identities?
Yes. When an employee connects an AI tool to Google Workspace, Microsoft 365, GitHub or Slack, the tool receives a token with its own scope and lifetime. That token should be inventoried, owned and reviewed like any other non-human identity.
What should security teams check first after the Vercel breach?
Review third-party OAuth grants in Google Workspace or Microsoft Entra, revoke unused apps and broad scopes, rotate secrets stored as non-sensitive environment variables and redeploy afterwards, and map which grants can reach systems that hold customer secrets.
Most teams can list their OAuth apps. Very few can say where each one leads. Elmoz maps AI agents and non-human identities across cloud and SaaS and shows which access paths reach your critical data.