Third-party AI hack triggers Vercel breach, internal environments accessed
Third-party AI hack triggers Vercel breach, internal environments accessed
Publish Date: 2026-04-20 06:18:00
Source Domain: securityaffairs.com
Third-party AI hack triggers Vercel breach, internal environments accessed
Pierluigi Paganini
April 20, 2026
Vercel suffered a breach after a hacked Context.ai tool exposed an employee account, letting attackers access limited internal systems and non-sensitive data.
Vercel reported a security breach caused by the compromise of a third-party AI tool, Context.ai, used by one of its employees. The attacker took over the employee’s Google Workspace account and used it to access parts of Vercel’s internal systems. This included some environments and non-sensitive variables, exposing a limited amount of customer-related data.
“The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee. The attacker used that access to take over the employee’s Vercel Google Workspace account, which enabled them to gain access to some Vercel environments and environment variables that were not marked as “sensitive.” reads the notice of security incident published by the company. “Environment variables marked as “sensitive” in Vercel are stored in a manner that prevents them from being read, and we currently do not have evidence that those values were accessed.””
Vercel is a cloud platform that helps developers build, deploy, and run modern web applications, especially front-end sites. It’s best known for supporting frameworks like Next.js, allowing teams to quickly publish websites and apps without managing servers directly. Vercel handles things like hosting, scaling, performance optimization, and global content delivery automatically.
According to the notice, the attacker showed a high level of skill, moving quickly and demonstrating deep knowledge of its systems. The company is working with cybersecurity firm Mandiant and other security partners to investigate the incident and has notified law enforcement. Vercel is also coordinating…
