Discussion

• @rauchg Guillermo Rauch on x

  I want to give you the rundown of the situation directly.  A Vercel employee got compromised via the breach of an AI platform customer called context.ai that he was using.  The details are being fully investigated.  Through a series of maneuvers that escalated from our colleague'…

• @diffekey Alex on x

  Vercel has reportedly been breached by ShinyHunters. As of now, nobody else appears to be posting about this, so I'm sharing what I have. Here is the information I've gathered, along with screenshots provided by ShinyHunters. #cybernews #shinyhunters #breach #vercel #news [image]

• @vercel @vercel on x

  Our investigation is ongoing. In the meantime, we have updated the security bulletin with best practices you can follow for peace of mind: https://vercel.com/...

• @k1rallik BuBbliK on x

  VERCEL GOT HACKED ShinyHunters - the group behind the Ticketmaster breach - is selling Vercel's internal database for $2M on BreachForums here's why every developer should care: - they have NPM tokens and GitHub tokens - Vercel owns Next.js - 6 million weekly downloads - one mali…

• @theo @theo on x

  I have reason to believe this is credible. If you are using Vercel, it's a good idea to roll your secrets and env vars.

• @darkwebinformer @darkwebinformer on x

  ‼️ Vercel has allegedly been breached by ShinyHunters, with a ransom demand of $2,000,000. https://vercel.com/... [image]

• @ohryansbelt Ryan on x

  Someone on BreachForums claiming to be ShinyHunters is selling what they say is Vercel's internal database, access keys, and source code for $2M. ShinyHunters is a black-hat hacker group known for a significant number of breaches and a “pay or leak” model. Vercel has confirmed a …

• @shiri_shh Shirish on x

  VERCEL just got breached. They're selling internal DB + employee accounts + GitHub/NPM tokens for $2M on BreachForums. looks like someone got early access to Claude Mythos 💀 [image]

• @vercel @vercel on x

  Our investigation has revealed that the incident originated from a third-party AI tool with hundreds of users whose Google Workspace OAuth app was compromised. We recommend that Google Workspace Administrators check for usage of this app immediately. https://vercel.com/...

• M Mohan M Mohan on linkedin

  Most people wont care to explain in plain english for non-developers, but here's what happened with Vercel and their security breach. …

• Sergio Alonso Sergio Alonso on linkedin

  https://lnkd.in/...  The Vercel breach is a tough reminder of the “who watches the watchers” problem in the modern stack. …

• Abhishek Agrawal Abhishek Agrawal on linkedin

  Vercel just disclosed that their April 2026 breach originated in a compromised Google Workspace OAuth app belonging to a third-party AI tool. …

• @zackwhittaker.com Zack Whittaker on bluesky

  In other Sunday news, cloud app giant Vercel says it's been hacked that involved “unauthorized access to certain internal Vercel systems.”  Some customers' affected, though it's not clear if any data was taken.  Doesn't say what the security incident is, though, exactly.  Unclear…

• r/webdev r on reddit

  Vercel Security Incident - rotate keys if you use their hosting

• Eric Wise Eric Wise on linkedin

  Oh look, a major breach *checks notes*  —  Yep, AI  —  https://lnkd.in/...

• Mack Nevill Mack Nevill on linkedin

  Vercel disclosed a platform breach yesterday, and the hacker group allegedly responsible are offering the dump for $2M on the darkweb right now. …

• @gergelyorosz Gergely Orosz on x

  I've confirmed that Context .ai was “audited” by Delve for SOC2 Redirects now deleted but https://trust.context.ai/ used to redirect to Delve themselves You cannot make this up...

• @cramforce Malte Ubl on x

  Because I've seen confusion about this: Context[.]ai is not the same company as the one that OpenAI acquired last April. We suspect the current owner, formerly known as context[.]inc, acquired the domain after that acquisition.

• @steventey Steven Tey on x

  Biggest takeaway from this: 3rd-party Google OAuth Apps that request scopes beyond the basic info (name/user/profile pic) is a dangerous attack vector. To safeguard your org from attacks like this, highly recommend asking your Google workspace admin to restrict “unconfigured [ima…

• @benjamindekr Benjamin De Kraker on x

  “We believe the attacking group to be highly sophisticated and ... significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.”

• @gergelyorosz Gergely Orosz on x

  The Vercel security breach is a reminder that each and every SaaS tool your team uses IS a security risk of its own - especially if they need broad data access to eg email, internet docs etc (many AI tools do just this) Security teams onboarding new vendors happens for a reason.

• @lulumeservey Lulu Cheng Meservey on x

  A good example — Don't wait for the investigation to be complete. Don't let PR and legal scare you into silence. Don't hide between deflections People just need to know, at a minimum, that you're personally leading the effort, that you care, that you're on it

• @mattjay Matt Johansen on x

  This is not a good look. Not only should Vercel's Google workspace not allowed an employee to accept all permissions to an OAuth token - to a company they weren't a paying contract holding customer of. This should've been easily detected by a number of security tools that audit […

• @zackkorman Zack Korman on x

  If you allow employees to authorize third party apps without admin approval then your entire vendor security review process is meaningless and you're going to get pwned. If this is true then Vercel was extremely negligent here. [image]

• @gergelyorosz Gergely Orosz on x

  Few things are more embarrassing for any company than to only learn from your customer that you have been breached. It's what happened with Context ai. Vercel acted as their security team. This could well be a business-ending event, as it shows the startup cannot be trusted. [ima…

• @yuchenj_uw Yuchen Jin on x

  > Vercel got pawned > severe enough to notify law enforcement > the only advice: “review your environment variables” > what does that even mean? > $10B company, and this is how you communicate Cyber attacks ramping fast, starting to see why Anthropic is scared to release Mythos.

• @avgdatabaseceo @avgdatabaseceo on x

  Vercel finally learns what it feels like to be on the receiving end of an outrageous surprise bill.

• @shawmakesmagic Shaw on x

  This vercel thing is a fucking apocalypse Hundreds possibly thousands of npm, pypi etc tokens not to mention tents of thousands of email, cloud provider keys etc Like why was this not encrypted what the actual fuck

• @vtahowe Allie Howe on x

  “We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity” Speed has always mattered in security response but now it's imperative I'll be leading a panel at AI Council in SF next

• Shubham Sharma Shubham Sharma on linkedin

  Woke up to the Vercel security incident blowing up on X this morning.  —  First thing I did:  — Rotated all environment variables on Vercel …

• r/technology r on reddit

  Cloud development platform Vercel confirms security breach

• r/vercel r on reddit

  Vercel confirms breach as hackers claim to be selling stolen data