The 2026 Vercel Shadow AI Breach

Jul 6

How an Unvetted Browser Extension Led to $2M Extortion

A recent deep-dive into the April 2026 Vercel security incident reveals how Shadow AI can serve as a dangerous supply-chain pivot, turning a simple productivity tool into a backdoor for attackers.

What started as an employee trying a consumer-grade AI browser extension escalated into a major breach. Attackers exploited stolen OAuth tokens to access corporate environments, enumerate customer data, and demand a $2 million ransom. No zero-day exploit or misconfigured cloud storage was needed — just an unmanaged AI integration using legitimate corporate credentials.

What Happened in the Vercel Incident

A Vercel developer installed an unvetted AI productivity tool (a browser extension from Context.ai) with their corporate Google Workspace account.
Upstream, an employee at the AI vendor fell victim to malware (Lumma Stealer), which harvested OAuth tokens and credentials.
Attackers used the stolen token to bypass MFA, move laterally, and exfiltrate customer environment variables.
The blast radius included sensitive (but unmarked) data, leading to extortion under the ShinyHunters persona.

This case highlights how Shadow AI creates "delegated identity bridges" with broad OAuth permissions that traditional perimeter defenses miss.

Key Lessons on Shadow AI Risks

Broad permissions = high risk: Tools promising productivity often request expansive access (e.g., Mail.Read, Files.Read.All) that turns them into persistent entry points.
Supply-chain amplification: A consumer tool adopted without review connected directly to enterprise systems.
Reactive controls fall short: Periodic audits detect problems too late. The perimeter has shifted to the moment of OAuth consent and browser-level adoption.
MITRE ATT&CK relevance: The attack leveraged techniques like Trusted Relationship (T1199), Application Access Token (T1528), and Valid Accounts (T1078.004).

How Sting Prevents These Exact Scenarios

Traditional security reacts after integration - Sting Software stops it at the source - in real time, at the browser level.

Our on-prem solution:

Discovers Shadow AI instantly when employees attempt to install extensions or grant OAuth access.
Blocks high-risk actions before tokens are generated or broad permissions are approved.
Intervenes at the moment of intent, educating users while preventing unauthorized bridges to tools like AI note-takers, summarizers, or coding assistants.
Covers the full spectrum: Shadow IT, Shadow AI, rogue spend, and more — without slowing down legitimate productivity.