Industry, Business & Companies · 2026-04-21

Vercel was hacked, this time from an AI tool.

English translation of the Chinese original. This version is generated for international readers and may be refined over time.

Interactive reading view ↗

English | Chinese Original

English translation of the Chinese original. This version is generated for international readers and may be refined over time.

Date: 2026-04-21

Event

On April 19, Vercel confirmed a security incident, Vercel's statement report. https://vercel.com/kb/bulletin/vercel-april-2026-security-incident.

The hackers claimed to have obtained internal data from Vercel, which was being sold at $2 million. Vercel subsequently issued a bulletin acknowledging that the system had been invaded and that the impact had affected some of its clients.

OpenAI, Cursor, Pinterst and Bose are all on Vercel's customer list. If the data were leaked, the impact would not be small.

How did it break

Vercel CEO Guillermo Rauch discloses details on X:

The starting point of the attack is an ** third party AI tool**.

A Vercel employee used a third-party AI tool whose Google Workspace Outlook application was invaded. Through this OAuth-applied access access, the assailant entered the employee ' s Google account, thus penetrating the Vercel internal system.

The whole link is:

Third party AI tool ** Contaminated OAuth application ** Employees Google account ** Vercel internal system

It's not a hole in Vercel's own code. It's a third-party tool security problem that drags Vercel together.

Vercel subsequently released CVE-2026-23869 to record the event and advised all clients to check their own environment variables, open sensitive environment variables and rotate keys as necessary.

Encryption developer panics first

And when this came out, the first move was on encryption developers.

Since Vercel hosts a large number of Web3 applications, they usually rely on API keys to access block nodes and wallet services. If these keys are leaked, the attackers can directly manipulate the user ' s funds.

So as soon as the message came out, a lot of encrypted projectors immediately started rotating API keys. The impact of this matter is not only in the technical circles; it is directly related to asset security.

Vercel highlighted a technical detail in his communication:

The assailant was able to access part of the Vercel environment and ** an environmental variable not marked sensitive'**. In Vercel, environment variables marked sensitive' will be stored in a way that cannot be readable, and there is currently no evidence that these sensitive values have been accessed."

However, many developers, out of convenience, did not turn on the "sensitive environmental variables protection" function. This means that stored as explicit environmental variables (e. g. API keys, database passwords, signature private keys) are high-risk exposures in this event.

A point worth thinking about

Vercel is an infrastructure company. Next.js was developed by them, EdgeFunctions, Servers, CI/CDs, which are standard products in the developers' circles.

But the stronger infrastructure does not hold the third-party AI tool for the employee computer.

It's not about Vercel. It's a whole industry problem.

How many developers are using various AI tools now? Writing assistant, code completion, translation, summary generation. These tools increasingly get your OAuth privileges -- access to your Google account, GitHub account, desk mail.

The depth of penetration of these powers may not even be clear to you.

Vercel was not punched in by a frontal attack, but brought in by a third-party tool on the flank. This is the path of the attack, and there's a name in the circle called ** Supply Chain Attack.**

** You're safe, but your tools are not safe, and you're not safe.**

Remember that.

Who's Shiny Hunters?

It was Shiny Hunters who claimed responsibility for the incident.

Hacker Forum Post

This hacker organization has been active recently, with the front foot attacking the GTA developer Rockstar Gomes, and now breaking Vercel. Their style is to invade large companies, steal data and sell publicly.

Two million dollars is not a bluff. If Vercel's data really contain the source code or key of a large customer, the price is not abnormal.

According to Vercel,** no sensitive data were accessed** and the services themselves were not affected, but only some clients.

But that would require a question mark.

Such cases of data disclosure usually take weeks from discovery to confirmation of the extent of the impact. Vercel says no now, doesn't mean no really.

For Vercel's clients, the time has come not to wait for official conclusions, but to check their own environment variables, rotate key, and confirm that there is no unusual access.

Vercel is a company that eats on a safety watch. The damage to brand confidence in this event is not a matter of how much it costs.

But the deeper question is, it's not the last company to be broken by "third party AI tool."

As AI tools increasingly permeate the day-to-day work of developers, their security risks are magnified simultaneously. These tools have the same level of security as your own code library.

Do you trust your AI assistant? Do you know what's behind that AI tool you used?

Most developers do not know.

This is a reminder for the whole industry: AI tool security, not just AI. Enterprises using these tools also have to include AI tools in their own security audit.

Otherwise, the next person to be dragged down by a third party will not be only Vercel.

Sources: