🧔♂️ A friendly human may check it before it goes live. More news here
Google-linked OAuth breach exposed Vercel customer data
US-based cloud app hosting firm Vercel said hackers breached its internal systems and accessed some customer data after a staff member linked a Context AI app to a corporate Google account through OAuth.
The attackers used the connection to take over the employee’s Google account and access internal systems, including unencrypted credentials. Vercel has contacted affected customers and advised them to rotate app keys.
A seller on a cybercrime forum claimed to represent ShinyHunters and offered customer API keys, source code, and database data from Vercel.
Context AI said a March breach may have compromised OAuth tokens for some users and may have been broader than initially thought.
🔗 Source: TechCrunch
🧠 Food for thought
Implications, context, and why it matters.
OAuth convenience can open a path into company systems
- The Vercel breach centered on OAuth, an authorization standard that lets third-party apps reach user data without a password 1.
- The entry point was Context AI, a connected OAuth app, not a direct break into Vercel’s own systems 2.
- The case also exposes shadow IT, when employees link unsanctioned apps to company accounts and leave gaps for IT teams 3.
- Google Workspace can limit third-party app connections, though those controls work only when IT admins set them up and enforce them 4.
Vercel warns companies about linking AI apps to work accounts
- The breach grew out of employees connecting new third-party tools, including AI apps, to work systems like Google accounts without enough security review 1.
- Hackers claimed they were selling access to customer API keys, source code, and database data allegedly taken from Vercel 2.
- A breach through a small outside app can still lead to broad access inside a company’s systems 1.
- Companies need close review and tight access rules for third-party apps, especially in the fast-moving AI sector 3.
Stay updated on the go with our mobile app.
Get latest insights with smoother, more personalized experience through TIA mobile app.