Vercel data breach via compromised third-party AI tool
Hackers exploited a compromised third-party AI tool called Context AI to breach Vercel's systems and steal customer data in April 2026. A group claiming affiliation with ShinyHunters offered the data for $2 million, though Vercel stated that sensitive information was not accessed and services remained unaffected.
What happened
Vercel, a cloud platform for hosting and deploying web applications, disclosed a security incident on April 19, 2026 in which attackers exploited a compromised third-party AI tool called Context AI to gain unauthorised access to internal systems.
The threat actors obtained access to an employee's Google Workplace account through the compromised AI tool and then accessed some of Vercel's environment variables. Hackers claiming to represent ShinyHunters offered to sell the stolen data for $2 million.
Reported impact
Only a limited number of Vercel customers were affected by the breach. Vercel stated that no sensitive data was accessed and that services were not impacted.
Index analysis
Vercel CEO Guillermo Rauch stated in a post on X that the attacking group was highly sophisticated and believed to be significantly accelerated by AI. The breach illustrates an emerging trend of hackers targeting third-party AI tools to carry out supply chain attacks, with recent compromises also affecting open-source AI projects such as Axios, LiteLLM, and Trivy.
Governance controls
Vercel said it was actively investigating with incident response experts, notified law enforcement, deployed extensive protection measures and monitoring, and analysed its supply chain to ensure Next.js was not affected.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.