Vercel Context.ai OAuth 2026 Data Breach

Vercel's official security bulletin directly confirms unauthorized access to internal systems, the origin of the attack, and compromise of customer environment variables. The initial review identified a limited subset of customers; broader log and indicator analysis found a small number of additional compromised accounts within the same April incident. Vercel contacted those customers with corrective steps.

BleepingComputer reported the bulletin and the Vercel CEO's technical explanation, corroborating the Context.ai account takeover, environment-variable enumeration, and customer advice. It also described a forum user's claims about source code, database data, and employee records, but could not independently authenticate them. LeakData therefore does not treat those claims as confirmed scope.

The verified class is customer environment variables stored on Vercel as “non-sensitive” and able to resolve to plaintext. An environment variable can be configuration, but users may also put API keys, access tokens, database credentials, or signing keys in it. Vercel advised customers to treat such values as potentially exposed and rotate them.

This list does not mean every affected customer stored every kind of secret. Vercel said customer environment variables marked sensitive are encrypted at rest; the incident progressed through values classified as non-sensitive and therefore readable.

Vercel says the Google Workspace OAuth application of a small third-party AI tool was compromised in a broader campaign. The attacker used that access to control the individual Google Workspace account of a Vercel employee who used the tool and then the employee's Vercel account. A pivot into the internal environment amplified the supply-chain effect of one account.

Vercel published the OAuth application identifier and urged Google Workspace administrators and account owners to check for use of the same app. The company assessed the actor as sophisticated based on operational speed and detailed knowledge of Vercel's product API surface and said it was working with Google Mandiant, other security firms, industry peers, and law enforcement.

The bulletin uses “limited subset” and later “small number of additional accounts” but provides no exact figure. Vercel's overall customer base, deployment count, and platform users are not the breach total.

The expanded review also found signs of compromise in a small number of other customer accounts that appeared separate from the April incident and were assessed not to originate on Vercel systems. The company contacted those accounts but did not classify them as continuation of the April breach or an earlier Vercel security incident.

Vercel confirmed through work with GitHub, Microsoft, npm, and Socket that no npm package published by Vercel was compromised and that there was no evidence of tampering. Next.js, Turbopack, and the company's other open-source projects remained safe. Public sources do not establish malicious package injection or impact to every deployment hosted on Vercel.

The company introduced an environment-variable overview and improvements for managing sensitive values. Customers should understand that deleting a project or account alone does not eliminate risk because a stolen secret may continue to provide access to an external production system. Potentially exposed values should be rotated first, followed by review of logs and connected services.

The incident date is based on the earliest technical activity that can be verified from public sources. The confirmed event is the Context.ai OAuth chain compromising an employee account, a pivot into the Vercel environment, and reading non-sensitive environment variables belonging to certain customers. The customer and record totals remain unknown.

Customers should treat API keys, tokens, database credentials, and signing keys stored in non-sensitive environment variables as potentially exposed and rotate them. Forum claims involving source code, databases, internal deployments, and 580 employee records were not confirmed by Vercel and are therefore excluded from data categories and numeric scope.