Vercel's breach earlier this year didn't start with an attack on Vercel at all. It started months earlier, with one employee granting a small third-party AI tool broad access to a Google Workspace account — a routine, low-friction decision that turned into the entry point for a much larger intrusion. For anyone studying AAISM Domain 2, it's a clean illustration of how vendor risk actually spreads: not through the vendor you assessed, but through the access you forgot you granted.
What Happened
Vercel disclosed a security incident in which attackers gained unauthorized access to a limited portion of its internal systems. The path in traced back to Vercel's own account of the incident: an employee had connected Context.ai, a third-party AI productivity tool, to their Vercel Enterprise Google account, granting it broad read access including Google Drive. That OAuth connection sat in place, unreviewed, for months.
The chain of compromise didn't begin at Vercel or even at Context.ai's product — it began with an infection on a Context.ai employee's own machine, reportedly via commodity credential-stealing malware. That foothold on the vendor's side gave attackers a way into the stored customer OAuth tokens Context.ai was holding — among them, the standing grant one Vercel employee had made months before. From there, the intrusion moved through the employee's Workspace account and on into Vercel's own environment.
The exposure that resulted was significant: customer environment variables, including API keys, database credentials, and deployment secrets, were compromised for a subset of Vercel's customers, according to reporting on the incident. Vercel said core products like Next.js and Turbopack were not affected, but the stolen data was later advertised for sale on a criminal marketplace.
The Risk Angle: Fourth-Party Exposure and Standing Access
Most vendor risk programs are built to evaluate the vendor directly in front of them — the AI tool a team wants to adopt. This incident shows why that scope is too narrow for AI tools specifically. The actual point of failure was two hops removed: a malware infection on an individual employee at the AI vendor, unrelated to anything the AI tool's own security posture might have looked like on a questionnaire. Analysis of the breach has framed this as a broader pattern with AI tools specifically — because they're adopted quickly by individual employees rather than provisioned centrally, the resulting OAuth grants often go untracked by the security team that would otherwise monitor and periodically re-review them.
The other structural issue is scope. The access granted to Context.ai wasn't limited to whatever the tool actually needed — it included broad Google Drive read permissions tied to an Enterprise account. That kind of over-provisioned, standing access is exactly what NIST's AI Risk Management Framework and general least-privilege principles both warn against, and it's what turned a single compromised laptop at a small vendor into a breach at one of its customers.
- Inventory AI tool integrations, not just AI tool vendors — a vendor risk assessment done at onboarding doesn't cover an OAuth grant made by an individual employee six months later, outside any formal review.
- Treat OAuth scope as a risk decision, not a default — broad, standing permissions to AI tools should be scoped to what the tool needs, and re-reviewed on a schedule, not granted once and forgotten.
- Extend vendor risk questions one hop further — for any AI vendor with access to your systems or data, ask what happens if one of their employees is compromised, not just what happens if their product is misused.
Want to go deeper on how this domain is tested on the AAISM exam? The AI Security Management Prep App covers this and 300 other practice scenarios, offline.
Explore the App — $9.99Related Reading
For the full exam breakdown, see the AAISM Certification Study Guide. For a related containment failure at a different layer of the stack, see The AI That Hacked Another Company. For the governance side of ungoverned AI tool adoption, see Shadow AI Governance Gap.
Sources
Vercel — Vercel April 2026 security incident bulletin
The Hacker News — Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials
Trend Micro — The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables
Push Security — Unpacking the Vercel breach: Shadow AI and OAuth sprawl