Vercel Breach Exposes OAuth Supply Chain Gap Security Teams Cannot Detect

A four-hop kill chain starting with a February 2026 Lumma Stealer infection on a Context.ai employee's machine gave attackers access to Vercel's production environment variables, exposing a class of OAuth-based supply chain risk that most enterprise security teams cannot detect, scope, or contain. Vercel CEO Guillermo Rauch disclosed the breach on Sunday after Mandiant's investigation traced the intrusion to an OAuth grant one Vercel employee had authorized for Context.ai's Chrome extension, which embedded "Allow All" permissions to the employee's corporate Google Workspace account. The twist: Context.ai itself had been compromised in March when attackers leveraged stolen credentials from the Lumma infection to access the vendor's AWS production environment, then pivoted into customer tenants via harvested OAuth tokens.

The dwell time (the period attackers remained undetected inside a compromised system) between Context.ai's March detection of the AWS breach and Vercel's Sunday disclosure underscores how OAuth-mediated vendor compromises can remain invisible to downstream customers for weeks, even when the upstream vendor has already engaged incident response.

What's new

The breach originated when a Context.ai employee's machine was infected with Lumma Stealer in February 2026, according to forensic evidence published by Hudson Rock. The infostealer harvested Google Workspace credentials, Supabase API keys, Datadog tokens, and Authkit credentials from the employee's browser storage. Attackers used those credentials to compromise Context.ai's AWS environment in March, then escalated by targeting downstream customers who had authorized Context.ai's Chrome extension.

Context.ai, an AI-powered productivity tool vendor, offered a browser extension that required OAuth permissions to users' corporate Google Workspace accounts. One Vercel employee had installed the extension and granted the OAuth permissions. When Context.ai's infrastructure was breached, the attacker gained access to those delegated OAuth tokens. Nudge Security CTO Jaime Blasco identified a second OAuth grant embedded within the Context.ai extension that enabled read access to users' Google Drive files, creating a secondary exfiltration path.

The attacker used the stolen OAuth tokens to authenticate into Vercel's internal systems as the compromised employee. From there, the attacker accessed environment variables that were not marked as "sensitive" in Vercel's platform. Variables without the sensitive designation were stored in plaintext and accessible via both the Vercel dashboard and API. The attacker escalated privileges by reading those non-sensitive variables, which included credentials for production systems.

Vercel, the cloud platform behind Next.js and used by millions of developers weekly, confirmed on Sunday that its npm packages remain uncompromised. The company worked with GitHub, Microsoft, npm, and Socket to audit all Vercel-published packages, including Next.js, Turbopack, and the AI SDK. OX Security conducted parallel analysis and confirmed no package tampering occurred. Google removed Context.ai's Chrome extension from the Chrome Web Store on March 27, weeks before Vercel's public disclosure.

Why it matters

The four-hop attack chain exposes a structural blindspot in enterprise security architectures. Traditional endpoint detection and response (EDR), cloud access security broker (CASB), and security information and event management (SIEM) tools are not designed to monitor third-party OAuth grants that employees authorize outside of IT approval workflows. When a SaaS vendor like Context.ai is compromised, the OAuth tokens it holds become immediate pivot points into every customer tenant that authorized access.

The nearly month-long dwell time between Context.ai's March detection and Vercel's disclosure demonstrates the cascading notification problem in OAuth supply chains. Context.ai hired CrowdStrike to investigate its AWS breach in March, but the company did not immediately identify which downstream customers had been accessed via stolen OAuth tokens. Vercel only learned of the compromise after conducting its own investigation, suggesting that OAuth-mediated breaches lack the telemetry and auditability that organizations rely on for traditional infrastructure intrusions.

Vercel's environment variable architecture amplified the impact. Variables not marked as "sensitive" were stored in plaintext and accessible via dashboard and API, a design choice optimized for developer convenience over security. Once the attacker authenticated via the stolen OAuth token, those variables provided direct access to production credentials. The breach proves that OAuth scopes function as de facto privilege grants, but most organizations do not treat them with the same rigor as VPN access, database credentials, or SSH keys.

The downstream risk extends beyond Vercel. Next.js serves millions of weekly npm downloads, and any package compromise would have propagated to build pipelines and production deployments across the JavaScript ecosystem. The fact that Vercel, GitHub, Microsoft, npm, and Socket found zero evidence of package tampering is the only reason this breach did not cascade into a broader supply chain event on the scale of the 2024 XZ Utils backdoor or the 2021 SolarWinds campaign.

What's next

Vercel announced it is now defaulting all new environment variable creation to "sensitive" status. Variables marked as sensitive are encrypted at rest and cannot be read through the dashboard or API, even by authenticated users. Existing non-sensitive variables must be manually migrated by customers. Vercel's Mandiant-led investigation remains ongoing, and the company has not disclosed the total number of affected customers or whether any customer data was exfiltrated.

Context.ai confirmed the breach affects only its deprecated AI Office Suite consumer product, not its enterprise Bedrock offering. The company hired CrowdStrike to investigate and published a security bulletin on Sunday, the same day as Vercel's disclosure. Hudson Rock published forensic evidence on Monday linking the breach to the February Lumma Stealer infection. Trend Micro analysis referenced a potential intrusion date as early as June 2024, but neither Vercel nor Context.ai has confirmed that timeline.

Security teams evaluating third-party SaaS tools should audit OAuth grants for scope creep, particularly Chrome extensions that request "Allow All" or Google Drive read access. Organizations should implement OAuth monitoring tools that provide visibility into which employees have authorized which applications and what permissions those applications hold. Vercel's response suggests the industry will move toward environment variable encryption by default, but the broader OAuth supply chain problem requires architectural changes that most cloud platforms have not yet implemented.

The breach exposes a fundamental mismatch between how enterprises think about supply chain risk and how modern SaaS architectures actually operate. Security teams invest heavily in vendor risk questionnaires, SOC 2 audits, and penetration testing, but none of those controls would have flagged a Chrome extension's OAuth permissions as a production access path. The four-hop chain from employee malware to vendor breach to OAuth token theft to production credential access represents a threat model that existing security stacks are not built to prevent or detect. The month-long gap between Context.ai's AWS compromise detection and Vercel's disclosure proves that even when upstream vendors engage incident response teams, downstream customers remain blind to OAuth-mediated lateral movement until they conduct their own forensic investigations.

-- Aria Lin, Enterprise Technology Analyst

Sources: Vercel · Context.ai · Mandiant