Shadow AI Tools Created a Security Breach at Vercel — Here’s What Every Business Needs to Know

A sophisticated cyberattack on Vercel — the company behind the widely used Next.js framework — reveals a growing threat hiding in plain sight: employees using third-party AI tools without IT oversight can create serious security vulnerabilities.

Key Takeaways

• The attacker gained access through Context.ai, an agentic AI tool used by a Vercel employee, which compromised that employee’s Google Workspace account — exposing internal Vercel environments and unencrypted credentials
• Hudson Rock traced the breach to a February 2026 infostealer infection of a Context.ai employee, where harvested corporate credentials gave the attacker the leverage to escalate into Vercel’s infrastructure
• Vercel CEO Guillermo Rauch noted the attack appeared to be “significantly accelerated by AI,” with the group moving with “surprising velocity and in-depth understanding” of Vercel’s systems

The incident underscores how “shadow AI” — tools adopted by employees outside formal security review — can cascade into enterprise-wide breaches. The breach also affected hundreds of users across many organizations through Context.ai’s compromised Google Workspace OAuth app.

Vercel is working with Google Mandiant and law enforcement to assess the full scale. They recommend enabling multi-factor authentication, rotating all credentials, and marking environment variables as sensitive.

Read the full article on CX Today