SAN FRANCISCO – Vercel, the web hosting giant and infrastructure behind the popular Next.js framework, confirmed this weekend a serious security incident that resulted in unauthorized access to its internal systems and the theft of data from a limited group of customers.
The attack, which highlights the supply chain risks in the age of artificial intelligence, did not originate from a vulnerability in Vercel's platform, but through a compromise in Context.ai, an external AI tool used by one of its employees.
The Origin: The Weakest Link Was an OAuth ConnectionAccording to the official security bulletin issued by Vercel, the attacker managed to compromise the Context.ai platform. Once inside that tool, they leveraged the OAuth integration to jump to a Vercel employee's Google Workspace account.
From that privileged position, the malicious actor was able to escalate access into Vercel's internal environments. The report details that the attackers managed to read environment variables that had not been marked as "sensitive" by users. While variables protected by Vercel's encryption system appear to have remained safe, the exposure of API keys and "non-sensitive" tokens represents a significant risk for the affected applications.
ShinyHunters and the Sale of Data on the Dark WebWhile Vercel worked with incident response experts from Mandiant, a threat actor linked to the group ShinyHunters claimed authorship of the attack on hacking forums. The attackers assert possession of over 580 employee records (including names, emails, and account statuses) and have put a data package up for sale for 2 million dollars.
As proof of the intrusion, the hackers shared screenshots of an internal company dashboard, generating a wave of concern among developers who rely on Vercel to host critical applications.
Reactions and Urgent MeasuresThe CEO of Vercel, Guillermo Rauch, confirmed that the company is directly notifying all customers whose credentials or data may have been compromised. "We are actively investigating and have involved cybersecurity experts and law enforcement," stated Rauch.
Among the immediate recommendations for Vercel users are:
Rotate all API keys and secrets located in their projects.
Review environment variable configuration, ensuring that all critical information is explicitly marked as "sensitive".
Audit access logs for unusual activity originating from Vercel's platforms towards its own databases or external services.
This incident underscores an alarming trend in 2026: the use of