Vercel breach exposes agentic AI access gaps in identity governance

At a glance

What this is: Nightfall argues that the Vercel breach exposed how a trusted third-party AI connection and an OAuth token can bypass perimeter controls and reveal internal systems, environment variables, and credentials.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to govern not just direct users but also connected AI tools, OAuth grants, and opaque third-party access paths.

Context

The governance gap here is not a single misconfigured control but the expansion of the access perimeter into third-party tools, AI connections, and delegated OAuth grants. Traditional inventory and DLP models assume security teams can enumerate the paths into an environment before they need to govern them, but agentic workflows and SaaS integrations make that assumption brittle.

In this case, the identity angle is central. A trusted connection held outside the organisation's direct control became the route into enterprise data, which means IAM and NHI teams have to treat connected tools as part of the access estate, not as adjacent software. That is now a typical failure pattern in modern cloud and AI-enabled environments, not an edge case.

Key questions

Q: What breaks when third-party AI tools have broad OAuth access to enterprise systems?

A: Broad OAuth access turns a convenience integration into a standing credential. If the token is compromised, attackers can move through trusted channels without defeating the perimeter. The main failure is not authentication alone, but the lack of scope control, revocation discipline, and visibility into what the connected tool can actually reach.

Q: Why do third-party integrations increase identity risk so quickly?

A: Third-party integrations increase identity risk because they extend trust through credentials, tokens, and delegated access rather than through direct human oversight. Once the supplier has standing access, your programme inherits the supplier’s governance quality. That is why inventory, expiry, and revocation discipline matter as much as vendor due diligence.

Q: What are the signs that OAuth consent governance is failing?

A: Common signs include broad scopes granted to unfamiliar applications, app registrations that survive beyond their business purpose, and consent events that are logged but not acted on. If reviewers only see the abuse in hindsight, governance is too slow for the risk level. The control needs policy, not just audit trails.

Q: What should security teams do when AI agents need access to tools and data?

A: Security teams should treat AI agents as runtime access actors and separate them from static machine identities. Limit tool scope, define approval gates, and require explicit revocation triggers for sessions and delegated access. The goal is to prevent broad runtime behaviour from inheriting static privileges.

Technical breakdown

Why OAuth grants become standing access paths

OAuth gives an application delegated authority without handing over a password, but broad scopes can turn that delegation into persistent access. When a user approves an integration with permissive consent, the token often remains valid until revoked, and the application can continue to act within the granted scope even if the original user never actively uses it again. In the Vercel case, that made the third-party connection function like a durable identity edge into corporate systems. Practical implication: treat every broad OAuth grant as an active access path, not a one-time setup event.

Practical implication: inventory delegated OAuth grants and revoke scopes that exceed the minimum required access.

How credential-harvesting malware feeds identity supply chain attacks

Credential-harvesting malware sits upstream of the visible breach. It captures session material, API keys, and tokens from a compromised endpoint, then lets an attacker reuse those secrets against cloud services and connected applications. The important mechanic is not the malware itself but the reuse chain it creates: one infected workstation can yield credentials that unlock multiple downstream systems if token hygiene, rotation, and revocation are weak. Practical implication: assume endpoint compromise can become cloud compromise when secrets live on the device.

Practical implication: shorten secret lifetimes and revoke tokens as soon as endpoint compromise is suspected.

Why MCP visibility matters for agentic AI governance

Model Context Protocol creates a standard way for AI agents to reach tools and data sources, but that convenience also hides access behind dynamic connections. Traditional logs and DLP often miss prompt-time retrieval, tool calls, and downstream responses, which means teams may know an AI agent exists but not what it can read or exfiltrate. The governance problem is therefore not just authorisation at connection time but continuous observability across the agent, the tools it can call, and the data it can surface. Practical implication: manage MCP as an identity and access surface, not only as an integration layer.

Practical implication: require visibility into every agent connection, tool call, and exposed data source before rollout.

Threat narrative

Attacker objective: The attacker sought trusted access into enterprise systems and sensitive development data by abusing delegated identity paths rather than breaking the perimeter.

1. Entry occurred when a Context.ai employee downloaded malicious files that installed Lumma Stealer on the endpoint.
2. Credential harvesting followed as the malware extracted logins, API keys, and OAuth tokens from the infected machine.
3. The attacker then reused a stolen OAuth token tied to a Vercel employee's Google Workspace account to move into internal systems and enumerate accessible data.
4. Impact included exposure of environment variables, source code, database credentials, and a limited set of customer credentials.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI tool access has become part of the identity perimeter. The Vercel case shows that the real governance boundary is no longer the corporate network edge but the web of OAuth grants, third-party tools, and agent connections attached to it. That changes IAM from account control to relationship control, because the organisation must now govern who or what can act through delegated access. Practitioners should treat connected AI tools as first-class identities in the access estate.

Observability is the missing control plane for agentic access. The central weakness in this incident was not simply excessive permission but the inability to see which external connections existed and what they could touch. When access paths are invisible, policy, classification, and enforcement all lose their target. That is why access-path observability is the named concept here: if security teams cannot inventory the route, they cannot meaningfully govern the data that moves through it. Practitioners should prioritise discovery before enforcement.

Standing OAuth consent is now a material NHI risk. A token that persists after its original purpose is no longer just an application integration detail. It becomes a durable machine-like credential that can outlive user intent, especially when third-party tools and AI workflows are involved. This is where NHI governance and identity governance converge: the same lifecycle discipline used for service accounts and API keys has to apply to delegated AI access. Practitioners should fold OAuth grants into NHI lifecycle control.

Traditional DLP misses the highest-value data in AI-enabled workflows. The article is right to show why pattern-based scanning fails when the sensitive asset is source code, system prompts, architecture notes, or roadmap material. Those items are operationally sensitive even when they are not personally identifiable, so the control problem is classification by context rather than format. Practitioners should align data protection with meaning, not just with PII signatures.

MCP will widen the governance gap unless teams treat it as a controlled identity surface. The scale of connected agents and tools means the next breach will not need exotic malware if the access layer stays opaque. Agentic systems can retrieve and move data through approved connections faster than conventional audit processes can review them, so governance has to move to issuance and connection time. Practitioners should use zero standing privilege thinking for AI tool access and agent connections.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Guide to the Secret Sprawl Challenge

What this signals

Access-path observability: the next control gap in AI governance is not merely whether a tool is authorised, but whether the organisation can see every live connection that tool uses. That shifts the programme from app approval to delegated-access governance, which is the only workable model for agentic workflows and third-party integrations.

MCP and OAuth together create a governance layer that looks transient to users but behaves persistently to defenders. Once a token or tool connection exists, security teams need lifecycle controls, classification at the data layer, and revocation logic that works at machine speed rather than review-cycle speed.

For practitioners

• Inventory all delegated OAuth grants Map every third-party integration connected to corporate identity systems, then flag grants with broad scopes, stale ownership, or no business justification.
• Classify AI tools as access-bearing systems Record which AI assistants, plugins, and MCP-connected services can reach internal repositories, chat spaces, databases, or document stores.
• Revoke standing tokens after endpoint compromise Build a response playbook that treats token theft on a workstation as a reason to invalidate OAuth tokens, API keys, and other credentials tied to that device.
• Upgrade classification beyond PII patterns Add source code, prompts, internal plans, and unreleased product data to sensitive-data handling rules even when those assets do not match regex-based DLP signatures.
• Require visibility before connecting MCP Do not permit agent-to-tool links until the team can see the connected server, the exposed tools, and the data returned through the interaction.

Key takeaways

• The breach demonstrates that trusted AI integrations can become direct access paths into corporate systems when OAuth grants and connected tools are not governed as part of the identity estate.
• Legacy DLP and inventory models are not enough when the sensitive assets include source code, prompts, internal plans, and machine-readable credentials that do not fit standard patterns.
• Security teams need discovery, revocation, and context-aware classification before they can claim control over agentic AI access and third-party tool connections.

Key terms

• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• MCP Connection: An MCP Connection is the live link between an AI agent and an external tool, data source, or service using the Model Context Protocol. It defines how the agent discovers capabilities, exchanges context, and requests actions. Security controls should govern authentication, authorization, scope, logging, and revocation for each connection.
• Standing Credential: A standing credential is any secret that remains usable until it is manually rotated or revoked. In NHI governance, it creates durable access that can be stolen, replayed, or propagated from trusted tooling unless runtime boundaries and expiry are built in.
• Access-Path Observability: Access-path observability is the ability to see which identities, tools, and connections can reach a system and what data flows through them. It is more than logging, because it requires inventory, context, and usable telemetry across delegated and machine-mediated access paths.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, machine identity security, and secrets management in a way that helps practitioners connect identity controls to modern access patterns. It is designed for teams that need to govern credentials, delegation, and lifecycle risk across both human and non-human access.