Vercel breach exposes agentic AI access gaps in identity governance

At a glance

What this is: Nightfall's analysis argues that the Vercel breach exposed a broader identity supply chain problem, where third-party AI tools and OAuth grants create hidden paths into enterprise systems.

Why it matters: This matters to IAM and NHI practitioners because every unmanaged integration, token, and agent connection can become a standing credential with reach beyond intended scope.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Nightfall's analysis of the Vercel breach and AI tool access risk

Context

The Vercel breach is a reminder that the real attack surface now includes connected AI tools, OAuth grants, and third-party services that can reach into identity environments. In practice, the problem is not only compromise of an endpoint or cloud account, but the trust relationship created when an employee connects an external tool to enterprise systems.

For identity and NHI teams, this is a governance problem as much as a technical one. A token with broad scope, an agent connection with no inventory, or an integration with no lifecycle review behaves like a standing credential even when it is not labelled that way. That pattern is increasingly typical in agentic AI environments, not an edge case.

Key questions

Q: What breaks when third-party AI tools have broad OAuth access to enterprise systems?

A: Broad OAuth access turns a convenience integration into a standing credential. If the token is compromised, attackers can move through trusted channels without defeating the perimeter. The main failure is not authentication alone, but the lack of scope control, revocation discipline, and visibility into what the connected tool can actually reach.

Q: Why do AI agents make non-human identity governance harder?

A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials. That increases the number of access paths security teams must supervise. The result is a stronger need for task-scoped access, explicit ownership, and continuous monitoring of what the agent can reach.

Q: How can security teams tell whether AI agent access is drifting out of scope?

A: Look for agents touching systems, data sets, or tools that are outside the intended task boundary, especially when those actions are not part of the approved workflow. Behavioural baselines, entitlement logs, and cross-system correlation are the key signals. If the agent can act meaningfully outside its original purpose, scope drift is already happening.

Q: Who is accountable when an AI integration is used to create administrative access?

A: Accountability sits with the teams that own the integration, the identity controls, and the downstream system it can touch. If a third-party service can create privileged accounts, then IAM, application owners, and security operations all share responsibility for the trust boundary and the resulting access decisions.

Technical breakdown

OAuth grants as standing credentials

OAuth is designed to delegate access without sharing a password, but delegated access becomes persistent authority when grants are broad, opaque, and rarely re-reviewed. In the Vercel case, a third-party connection tied to a user account created a trusted path that outlived the moment it was approved. The security issue is not OAuth itself, but the absence of lifecycle controls around consent, scope, and revocation. In identity terms, this is a non-human access problem hiding inside human approval flows. Without governed offboarding of app access, a compromised integration can behave like a durable backdoor.

Practical implication: inventory OAuth grants, enforce scope minimisation, and revoke unused integrations on a defined lifecycle.

Why MCP expands the visibility problem

Model Context Protocol lets AI agents connect to tools and data sources through standardised integrations, which makes adoption easier and governance harder at the same time. The issue is that many security tools were built to monitor user sessions, endpoints, or API traffic, not agent tool calls and prompt-mediated retrieval. That leaves a gap between what an agent can access and what defenders can observe. When an AI system can query repositories, databases, or document stores through MCP, access control is only meaningful if the connection, tool, and data path are all visible.

Practical implication: map every agent-to-tool path and require logging at the connection and tool-call layer.

Context-aware classification replaces pattern-based DLP

Traditional DLP is strong at recognising fixed patterns such as payment card numbers or national identifiers, but weak at identifying high-value contextual data like source code, internal roadmap documents, prompts, or database credentials. The Vercel case shows why that matters: the data most worth protecting often does not look sensitive to a regex engine. Modern controls need semantic classification that understands business context, not just formatting. For agentic workflows, the classification layer must operate before data leaves the trusted boundary and before an AI system can reuse it elsewhere.

Practical implication: extend classification to source code, prompts, and internal business documents, then enforce at the retrieval layer.

Threat narrative

Attacker objective: The attacker wanted to pivot from a compromised third-party connection into internal systems and sensitive data without breaching the target perimeter directly.

1. Entry began with credential-harvesting malware that infected a third-party employee machine after a malicious download.
2. Escalation followed when stolen logins, API keys, and OAuth tokens were reused to reach a connected AWS environment and a Google Workspace-linked Vercel account.
3. Impact came from an overly broad OAuth grant that exposed internal systems, environment variables, and a limited set of customer credentials.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The Vercel case is an identity supply chain failure, not a perimeter failure. The attacker did not need to defeat the target's core defences because a trusted third-party connection already existed. That changes the governance question from “Can we block intrusion?” to “Which external connections can already act inside our environment?” For IAM and NHI programmes, the implication is straightforward: every delegated connection needs the same lifecycle discipline as any other privileged access path.

Agentic AI creates a hidden class of non-human access that traditional inventories do not capture. When employees connect tools, agents, and data sources, they create machine-mediated access chains that sit outside normal user entitlement review. This is where the NHI and agentic AI intersection becomes operational, because the real subject is not just the user account but the system-to-system trust relationship it authorises. That makes OWASP NHI Top 10, OWASP Agentic AI Top 10, and NIST CSF relevant as governance lenses.

Observability is now a control objective, not just a monitoring preference. If defenders cannot see which AI tools, OAuth grants, and MCP connections exist, then classification and enforcement are necessarily partial. The named concept here is connection blind spot: a state where access exists, but governance teams cannot inventory or review it in time. Practitioners should treat that blind spot as a control gap with direct breach potential, not as an inconvenience.

Context, not format, is the new boundary for sensitive data governance. The article shows why source code, prompts, internal plans, and credentials matter even when they do not fit legacy DLP patterns. That widens the remit of IAM-adjacent governance into data security and AI control planning. The practical conclusion is that identity governance must extend into the data path that AI tools can reach, or the trust model will keep outrunning policy.

The market signal is moving toward unified oversight of identity, data, and AI tool access. As more enterprises adopt agentic workflows, the separation between IAM, DLP, and AI governance becomes harder to defend. Programs that keep these domains isolated will miss the combined risk surface created by delegated access, unmanaged integrations, and machine-speed retrieval. The direction of travel is toward joint control models, not siloed review cycles.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• From our research: See the 52 NHI Breaches Analysis for breach patterns that show how hidden connections and unmanaged credentials turn into incident paths.

What this signals

Connection blind spot: the organisations most at risk are not the ones with no controls, but the ones whose controls stop at the human account and never extend to external tool connections. That gap will become more visible as agentic AI adoption increases and more workflows depend on delegated access across SaaS, MCP, and identity platforms.

The programme implication is that IAM teams will need closer alignment with data security and AI governance than many current operating models allow. Controls that work only at approval time will miss the runtime reality of prompts, tool calls, and cross-system retrieval. External references such as the OWASP Non-Human Identity Top 10 and the OWASP Agentic AI Top 10 are increasingly relevant for this convergence.

Security leaders should expect audits to move from asking who approved access to asking what the connected system could actually do with it. That shift will pressure entitlement review, offboarding, and exception management to include non-human paths, not just employee accounts.

For practitioners

• Audit third-party OAuth grants Identify every external application connected to enterprise identities, classify the scopes it holds, and revoke grants that are no longer required or cannot be justified by owner and business purpose.
• Inventory AI tool and MCP connections Build a live register of AI assistants, MCP servers, and other tool connections so security teams can see which systems they can reach and which identities they rely on.
• Extend classification to AI-retrieved content Treat source code, prompts, internal plans, and credentials as sensitive categories even when they do not match PII patterns, then enforce controls at retrieval and export points.
• Tie revocation to access lifecycle events Connect employee offboarding, app decommissioning, and policy exceptions to immediate revocation of tokens, integrations, and machine-access paths that could persist beyond their intended use.

Key takeaways

• The breach illustrates how a single trusted integration can become a full intrusion path when governance does not follow the connection.
• The material risk is not only credential theft, but the organisational inability to see which tools and agents can act inside core systems.
• Practitioners should shift from isolated access reviews to continuous oversight of OAuth grants, agent connections, and data classification at runtime.

Key terms

• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• Standing Credential: A standing credential is any secret that remains usable until it is manually rotated or revoked. In NHI governance, it creates durable access that can be stolen, replayed, or propagated from trusted tooling unless runtime boundaries and expiry are built in.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Coverage Blind Spot: A coverage blind spot is any part of the environment where monitoring does not see data movement, storage, or sharing activity. For DLP, blind spots often appear in SaaS services, collaboration tools, APIs, and unmanaged workflows that fall outside older perimeter-based designs.

What's in the full article

Nightfall's full article covers the operational detail this post intentionally leaves for the source:

• Nightfall's step-by-step reconstruction of the Vercel compromise chain from the initial malware infection to the OAuth pivot.
• The article's explanation of why legacy DLP misses source code, prompts, and internal business documents that matter in AI workflows.
• Nightfall's discussion of MCP observability, including what teams need to see at the agent, tool, and data-flow layers.
• Practical detail on how Nightfall frames classification and enforcement across AI-connected environments.

👉 The full Nightfall article covers the breach chain, MCP exposure, and the limits of legacy DLP.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps practitioners translate access, lifecycle, and accountability principles into operating controls.