A data security breach at US cloud application company Vercel has prompted urgent customer notifications and drawn attention to the risk that employees using third-AI tools could open additional attack vectors for hackers to steal customer information.
Vercel provides developer tools and cloud infrastructure, including the widely used Next.js web development framework for React that it created and maintains. The company issued a bulletin on April 19 stating that it had discovered unauthorized access to certain internal systems and indicated that some customers’ accounts were compromised.
“Initially we identified a limited subset of customers whose non-sensitive environment variables stored on Vercel (those that decrypt to plaintext) were compromised. We reached out to that subset and recommended an immediate rotation of credentials.”
The bulletin added the company is investigating “whether and what data was exfiltrated” and will contact customers if it discovers further evidence of their information being compromised.
The investigation found that the attacker gained access to Context.ai, a third-party agentic AI tool used by a Vercel employee, which allowed it to take over the employee's Vercel-issued Google Workspace account to breach some Vercel environments and environment variables that were not marked as sensitive.
The company fully encrypts variables that are marked as sensitive to prevent them from being read, and the bulletin stated that “we currently do not have evidence that those values were accessed.”
It turns out that Context.ai’s Google Workspace OAuth app was the subject of a broader security compromise, potentially affecting “hundreds of users across many organizations,” Vercel warned. The company recommends that Google Workspace Administrators and Google Account owners check for usage of the app immediately.
Vercel’s CEO, Guillermo Rauch, provided more detail in a post on X, stating:
“We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.”
Rauch added that the company analyzed its supply chain to make sure that Next.js, the Turbopack bundler built into Next.js, and its open-source projects remain secure.
A subsequent update to the bulletin on April 20, 5:32 PM PST stated: “In collaboration with GitHub, Microsoft, npm, and Socket, our security team has confirmed that no npm packages published by Vercel have been compromised. There is no evidence of tampering, and we believe the supply chain remains safe.”
Vercel is also working with Google Mandiant and other cybersecurity firms, industry peers, and law enforcement, as well as Context.ai, to understand the full scale of the security compromise.
The company recommends that customers enable multi-factor authentication and make use of the sensitive environment variables feature.
As compromised credentials can still provide access to production systems, customers need to rotate them before deleting Vercel projects or accounts. Customers should also review their account activity logs and environments for suspicious activity and investigate recent deployments for unexpected or suspicious-looking activity, deleting any that appear to be suspicious, according to the bulletin.
Vercel Breach May Indicate Wider Attack on Enterprise Credentials
AI chat app developer Theo Browne also warned on X that the breach could extend further:
“The method of compromise was likely used to hit multiple companies other than Vercel.”
Austin Larsen, Principal Threat Analyst at Google Threat Intelligence Group, warned in a LinkedIn post that Vercel users should check whether their systems have been affected. “If your organization relies on their infrastructure, I strongly recommend you start looking into this immediately,” Larsen wrote.
The hacker claimed to be part of the notorious ShinyHunters group, but Larsen noted that “likely this is an imposter attempting to use an established name to inflate their notoriety.”
Israeli cybersecurity firm Hudson Rock connected the dots between an infostealer attack on Context.ai and the Vercel breach.
“In a February 2026 Lumma stealer infection, a Context.ai employee with sensitive access privileges was compromised. A deep dive into the infected machine’s browser history provides a textbook example of how these breaches originate,” the firm noted.