Vercel Confirms Security Incident Originating from Third-Party AI Tool Compromise

Vercel has confirmed a security incident involving unauthorized access to internal systems, with reports linking the sale of internal Vercel databases—including access keys, API keys, NPM, and GitHub tokens—to the same threat group reportedly behind the recent Ticketmaster breach. The breach originated from a sophisticated attack chain, starting with the compromise of Contexi AI, a third-party artificial intelligence tool used by a Vercel employee.

The initial compromise of Contexi AI reportedly occurred in February 2026 when one of its employees inadvertently used a Roblox game script containing Luma Stealer malware. This led to the theft of Contexi AI’s AWS environment variables and Auth tokens. Attackers then leveraged the Vercel employee’s Google Workspace login via Contexi AI to pivot into Vercel’s environment, where they enumerated non-sensitive environment variables. Vercel clarified that its Next.js ecosystem, with millions of downloads, and official NPM packages were not compromised. Vercel reported a limited impact on a “small number” of customer accounts and engaged Google, Microsoft, NPM, and other cybersecurity partners to mitigate the incident, recommending users enable Multi-Factor Authentication (MFA) and promptly rotate any potentially compromised secrets.

However, Vercel faced significant criticism regarding its customer notification strategy. Numerous clients, including paying team subscribers, reported learning about the incident through social media rather than direct email, sparking concerns about GDPR compliance and the timeliness of disclosure. This incident also brought scrutiny upon Contexi AI’s SOC 2 Type 2 certification, which was obtained through Delve, a security compliance provider whose automated certifications have been questioned for not always meeting basic security standards. The complex origin of the Vercel breach underscores the evolving landscape of supply chain attacks and the critical importance of scrutinizing third-party security postures.