Breachesby GlyphVercel
Disclosed Apr 19, 2026Confirmed
Breach at AI app maker Context AI led to theft of Vercel customer credentials
A Vercel employee connected Context AI's app to a corporate Google account; attackers who breached Context AI used that OAuth link to take over the account and reach internal systems holding unencrypted customer credentials. Vercel notified affected customers and advised rotating keys.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Apr 19, 2026 |
| Discovered | Apr 2026 |
| Attack | Supply chain |
| Data exposed | API keysCredentials and tokensSource code |
| Sector | Tech · US |
| Status | Confirmed |
Sources
Notices filed
History of this record
Vercel said attackers hijacked an employee's Google Workspace account through a compromised Context.ai OAuth app and accessed internal systems, stealing API keys, app credentials and other data of hundreds of users across many organizations to A Vercel employee connected Context AI's app to a corporate Google account; attackers who breached Context AI used that OAuth link to take over the account and reach internal systems holding unencrypted customer credentials. Vercel notifiedby seedSource
Vercel breached via Context.ai OAuth app, customer secrets stolen to Breach at AI app maker Context AI led to theft of Vercel customer credentialsby seedSource
First recordedby seedSource
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.