Vercel Breach: What the Context AI Hack Actually Exposed

How the attack unfolded — step by step

The breach did not start at Vercel. It started months earlier with a malware infection on a device belonging to a Context.ai employee.

In February 2026, Hudson Rock found evidence that the Context.ai employee was compromised with Lumma Stealer— a commodity infostealer sold on criminal forums. The stolen credentials included Google Workspace logins, Supabase keys, Datadog tokens, and Authkit logins. The “support@context.ai” account was among the harvested records.

The employee had apparently been downloading Roblox “auto-farm” scripts — a classic Lumma Stealer delivery vector. With those credentials in hand, the attacker gained access to Context.ai's AWS environment in March 2026.

Context.ai said it identified and blocked the intrusion — but the attacker had already harvested OAuth tokens for consumer users of the product, including at least one Vercel employee who had signed up with their enterprise Google account and granted “Allow All” permissions.

The pivot: from Context.ai into Vercel

With a live OAuth token tied to a Vercel employee's Google Workspace account, the attacker pivoted directly into Vercel's internal systems.

According to Vercel, the attacker accessed environment variables not marked as “sensitive” across Vercel environments. Environment variables flagged as sensitive are stored encrypted and cannot be read even by Vercel employees — the company says there is currently no evidence those were accessed.

Vercel described the threat actor as “sophisticated” — citing their operational velocity and detailed understanding of Vercel's systems.

ShinyHunters and the $2 million listing

A threat actor using the ShinyHunters persona — a name associated with high-profile breaches including Ticketmaster (2024) — has claimed responsibility for the Vercel hack and is reportedly selling the stolen data for an asking price of $2 million.

Vercel has not confirmed which specific data was exfiltrated or how many customers are affected. A “limited subset” of customers has been contacted directly with instructions to rotate credentials.

The company is working with Google-owned Mandiant, additional cybersecurity firms, and law enforcement. It has also engaged Context.ai to establish the full scope of the breach.

What Vercel users need to do right now

Vercel has published official guidance. Here is the full checklist, translated from their bulletin into plain language.

The real lesson: third-party AI tools are a new attack surface

This breach did not start with a Vercel vulnerability. It started with an employee downloading a gaming cheat script on a personal activity, which installed an infostealer on a machine with access to a third-party AI tool that had broad OAuth permissions to enterprise infrastructure.

That chain — personal device compromise → credential theft → third-party SaaS → enterprise identity system → production infrastructure — is exactly the model that nation-state actors and organised criminal groups have been refining for the past three years.

The attack surface for any business is no longer defined by the tools it controls — it is defined by the tools its employees and vendors use and the permissions those tools carry.

Vercel CEO Guillermo Rauch stated that Next.js, Turbopack, and Vercel's open source projects remain safe — but the company has already shipped new dashboard tooling for environment variable management and sensitivity controls in response to this incident.

Organisation-level controls that would have broken this chain