A third-party AI tool trusted by a single Vercel employee turned into the entry point for one of the most closely-watched cloud infrastructure breaches of 2026.  Cloud platform <b> Vercel disclosed the security incident </b> after threat actors claiming to be ShinyHunters posted on a hacking forum, alleging they had breached Vercel and were selling access to company data. For a company that hosts deployment infrastructure for millions of developers — and stewards Next.js, the internet's most popular React framework — the fallout extends well beyond Vercel's own systems. Vercel traced the intrusion to Context.ai, a third-party AI tool used by an employee, where a compromised Google Workspace OAuth connection allowed attackers to escalate access into Vercel's internal environments.  The sequence was clean and fast. Context.ai has also published a security bulletin disclosing a March 2026 incident— meaning the attackers had nearly a month of dwell time before making their move on Vercel. …
