AI SecuritySupply ChainOAuthVendor RiskResearch

A Roblox cheat burned Vercel

A Context.ai employee downloaded a Roblox cheat and it ended with Vercel customer data for sale on BreachForums. The connector was a single OAuth grant.

TL;DR

In February, a Context.ai employee installed a Roblox cheat infected with the Lumma infostealer. Two months later, Vercel customer data hit BreachForums with a two-million-dollar price tag. The bridge between a video game cheat and an enterprise breach was a single OAuth grant. Third-party AI tool risk is no longer theoretical, and current vendor review programs are entirely blind to it.

The short version

A Context.ai employee downloaded a Roblox auto-farm script. That script dropped Lumma, an infostealer that immediately harvested Google Workspace credentials, Supabase keys, Datadog logins, and the support@context.ai account. From there, the attacker simply walked into Context.ai’s customer relationships.

One of those customers was a Vercel employee who had authorized Context.ai with full read access to his corporate Google Drive. The OAuth token did what OAuth tokens do. The attacker hijacked the account, pivoted into Vercel’s internal systems, and walked out with unencrypted credentials and customer data. Vercel confirmed the breach on April 19, and the BreachForums listing appeared shortly after. That is the entire kill chain. A video game cheat on one laptop ended with Vercel customer API keys for sale on the dark web.

This is a vendor risk problem wearing a breach headline

Vercel is the name on the story because Vercel is large and visible, but the mechanics happened upstream. Context.ai is a small productivity tool with a few hundred users. It is the exact kind of app an employee signs up for with a work Google account on a Tuesday afternoon to summarize documents.

Modern vendor risk programs fail to catch this. Context.ai is not in the Configuration Management Database. Procurement never reviewed it. It has no Master Services Agreement, no SOC 2 report on file, and no sales contact. It simply has an OAuth consent screen that a Vercel employee clicked through. After that click, an external service had permanent read access to a corporate Drive. That single click expanded the attack surface, and nobody told the security team.

OAuth is the new VPN

A decade ago, the shadow IT problem was employees storing files in a personal Dropbox. The issue was storage, and Data Loss Prevention tools mostly caught up. The current version of this problem is OAuth grants to AI tools, and DLP is useless here because the data never moves through any pipe security owns. The AI tool pulls data directly from Google Workspace, Microsoft 365, Slack, or Notion using a valid token issued by the employee.

The OAuth scope dictates the blast radius. An application with drive.readonly access can read every file the employee can read. In a flat corporate Drive, that often means everything. An app with mail.read can read every email thread where an administrator accidentally pasted a password. When that tool gets breached, the attacker inherits those exact scopes across every user who ever signed up. They need no phishing email and no malware on a corporate device. They just need a compromised vendor holding live tokens.

What the Trend research makes explicit

Trend Micro’s recent post-mortem on the incident exposed the detail most coverage skipped: the theft of platform environment variables. As Trend outlined, Vercel customer environment variables typically include database credentials, payment processor keys, and third-party API tokens. All of these were swept up in the compromised export.

For any Vercel customer caught in that blast radius, the Vercel breach is now their breach. They do not have the luxury of waiting for the next board meeting to decide whether to rotate their keys. This pattern is accelerating. A central platform hoards concentrated secrets from thousands of customers. That platform gets compromised through a vector completely disconnected from its own security posture. Suddenly, everyone downstream is exposed to a disastrous decision they did not make.

What to do before the next one

Security leaders must stop treating this as an optional problem. The immediate first step is to inventory OAuth grants across Google Workspace and Microsoft 365 at the tenant level. Most organizations have ignored this list for years, and it is inevitably longer than expected, packed with tools nobody in the security department recognizes. From there, administrators must define a strict scope ceiling for consumer AI tools. No app should hold drive.readonly access against corporate Drives without a rigorous review. Admin consent workflows exist for this exact reason, yet most tenants leave user consent enabled by default.

Security teams need to assume any central platform holding customer secrets is already a target. Organizations should rotate keys on the assumption of periodic compromise, not disclosure. As Safe Security noted in their analysis, Vercel customers who already rotated credentials quarterly were ahead of schedule on April 19. Treat an OAuth grant to an AI software service exactly like a service account with identical scope. Log it, review it, and revoke it the minute the employee leaves. The current industry habit of doing absolutely none of these things only holds up because attackers are just now catching on.

The regulatory hammer is also falling. The EU AI Act high-risk obligations go live on August 2. Organizations building conformity packages will have to prove governance over this exact exposure: which AI tools can see what data, with what authority, and how that access is logged. This breach is a preview of the disasters that paperwork is supposed to prevent.

The unpleasant part

A Context.ai engineer installed a pirated Roblox script, and it cost an unknown number of enterprise Vercel customers their database keys. There is no elegant architectural lesson that makes this reality easier to swallow. The attacker did not need a sophisticated zero-day exploit. They just needed one employee with terrible internet habits at a tiny vendor whose existence most of the downstream victims could never have named. Millions of dollars in enterprise security budgets were completely neutralized by a guy trying to farm digital currency in a children’s game.

The cybersecurity industry spent a decade securing the endpoint, then another decade building impenetrable cloud fortresses. Now, we get to watch both paradigms bypassed by a single OAuth token issued in a browser tab. The AI tool inventory is now your vendor inventory. Start treating it that way before a bored gamer burns your infrastructure to the ground.

Sources

← All posts