Vercel Got Hacked Through an AI Tool. Now Hackers Want $2 Million

Server room with rows of network equipment and blue lighting — Photo via Unsplash

TL;DR: Vercel confirmed on April 19, 2026 that attackers breached its internal systems through a compromised third-party AI tool called Context.ai. The attackers exploited a Google Workspace OAuth connection to pivot inside Vercel's environment, accessing employee records and non-sensitive environment variables. Someone claiming ShinyHunters affiliation posted 580 employee records on BreachForums and is asking $2 million for the full dataset, including alleged API keys, source code, and database contents. Crypto projects on Vercel are rushing to rotate credentials. Next.js and Vercel's open-source projects were not compromised.

An AI Tool Was the Front Door

The attack chain started outside Vercel entirely. Context.ai, an enterprise AI platform for building automated workflows, was compromised first. Hundreds of users across multiple organizations were affected ^[1].

A Vercel employee had connected Context.ai to their Google Workspace account with deployment-level OAuth scopes. That's the opening. The attacker compromised Context.ai, used it to access the employee's Google Workspace, then pivoted into Vercel's internal systems ^[2].

From there, the attacker enumerated Vercel's environment, exploiting integrations with Linear and GitHub to expand access ^[3]. They reached environment variables flagged as "non-sensitive", which in Vercel's architecture means they're readable, unlike "sensitive" variables that are encrypted and write-only.

One OAuth token. One employee. One AI tool nobody audited properly. That's all it took.

What the Attackers Claim to Have

On April 19, someone claiming ShinyHunters affiliation posted on BreachForums with a sample: 580 employee records containing names, Vercel email addresses, account status, and activity timestamps ^[4].

The asking price for the full dataset: $2 million, with a "flexible" starting point of $500,000 in Bitcoin ^[4].

The claimed haul goes well beyond employee data:

Internal API keys, NPM tokens, and GitHub tokens
Source code repositories
Database contents
Screenshots of internal enterprise dashboards
Access to internal deployments

There's a twist, though. People linked to recent ShinyHunters activity told BleepingComputer they weren't involved in this breach ^[4]. Either the poster is lying about the affiliation, or ShinyHunters has splintered enough that members don't always know what the others are doing.

Vercel hasn't confirmed or denied the scope of what the attacker claims to have. CEO Guillermo Rauch said the number of affected customers was "quite limited" but gave no specific figures ^[1].

Why This Is Bigger Than One Company

Vercel hosts millions of web applications. Next.js, which Vercel develops, gets roughly 6 million weekly downloads ^[3]. If an attacker had compromised Vercel's build systems (and there's no evidence they did), they could have tampered with packages that half the internet depends on.

Vercel explicitly confirmed that Next.js, Turbopack, and its open-source projects were not affected. A supply chain audit found no tampering ^[1]. That's the good news.

The bad news: "non-sensitive" environment variables on Vercel aren't necessarily harmless. Developers routinely store third-party API keys, webhook URLs, and configuration secrets in non-sensitive variables because the "sensitive" flag restricts how the variable can be used. If you built on Vercel and stored anything valuable in a non-sensitive env var, you should treat it as compromised.

Crypto Developers Are Scrambling

Web3 and crypto projects took the hardest immediate hit. These teams store API keys that connect wallet interfaces and trading dashboards to backend services, and many of them host on Vercel ^[5].

Orca, a Solana-based decentralized exchange, confirmed its frontend runs on Vercel and rotated all deployment credentials as a precaution. The exchange said its on-chain protocol and user funds were unaffected ^[5].

Other crypto teams followed suit, rushing to rotate API keys and audit their Vercel configurations. In the crypto world, a leaked API key can drain wallets in seconds. The window between breach and credential rotation is the danger zone.

The AI Tool Supply Chain Problem

This breach fits a pattern that's getting harder to ignore. AI tools are being integrated into enterprise environments with broad OAuth permissions, and nobody is auditing them.

Context.ai had Google Workspace OAuth access inside Vercel. That means it could read and act on behalf of Vercel employees within Google's ecosystem. When Context.ai was compromised, that access became the attacker's access.

This is the same category of risk that hit Mercor earlier this month, where a poisoned LiteLLM Python package led to 4TB of data stolen from a $10 billion AI startup. And Snowflake last year, where compromised credentials at a third-party contractor exposed data from AT&T, Ticketmaster, and Santander.

The pattern: companies integrate third-party tools with broad permissions. Those tools get breached. The attacker walks right in through the front door because someone already held it open.

Vercel published an indicator of compromise (an OAuth app ID) and recommended that Google Workspace administrators audit their OAuth app configurations immediately ^[1].

What to Do Right Now

If You Deploy on Vercel

Rotate all environment variables, especially those marked non-sensitive. Vercel rolled out dashboard updates for managing env vars. Use them. Check activity logs for unauthorized deployments or configuration changes.

If You Use Context.ai

Revoke its OAuth access in your Google Workspace admin panel immediately. Check the OAuth app ID Vercel published: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com. If you see it, remove it.

Audit Your AI Tool Permissions

Check every AI tool connected to your workspace. What OAuth scopes does it have? Can it read your email? Access your files? Deploy code? If you can't answer these questions, you have a Context.ai-shaped hole in your security.

Treat Non-Sensitive Env Vars as Leaked

If you stored API keys, database URLs, or any credentials in Vercel non-sensitive environment variables, rotate them now. Don't wait for Vercel to tell you if you were specifically affected.