Vercel breach shows shadow AI is a governance blind spot

At a glance

What this is: This is an analysis of how a Vercel breach reportedly began with an unapproved AI tool, a broad OAuth grant, and a stolen token that moved across SaaS and internal systems.

Why it matters: It matters because IAM, IGA, and NHI programmes must govern SaaS integrations, OAuth consent, and third-party access paths, not just user logins and endpoint controls.

By the numbers:

• 78% of employees use AI tools like ChatGPT and Claude.
• Only 30% of organizations have full visibility into what those tools are.

Context

Shadow AI creates a governance gap when employees connect unapproved AI tools to work accounts and data flows outside IT review. In this case, the breach started with a work Google account, a third-party AI app, and an OAuth permission grant that expanded the tool's effective access.

For IAM and NHI teams, the core issue is not simply tool usage. It is delegated access that persists beyond business oversight, making SaaS permissions, third-party tokens, and consent screens part of the identity attack surface.

The Vercel case is typical of how unsanctioned integrations enter an environment: quietly, through a legitimate user action, before security teams have any inventory or policy leverage.

Key questions

Q: What breaks when employees can approve unreviewed AI apps with OAuth access?

A: The control that breaks is delegated trust. A single user click can give a third-party app the same effective access as the employee, even when IT has no inventory, contract, or policy decision on record. That makes broad consent a governance gap, not just a usability choice.

Q: Why do shadow AI incidents drive breach costs higher for organisations?

A: Shadow AI increases breach cost because it often handles sensitive personal and intellectual property data outside approved controls. The report says these incidents take longer to detect, add roughly $200,000 to average breach cost, and can rise to $670,000 in high-use environments. Unapproved AI tools expand the attack surface while reducing visibility, governance, and response speed.

Q: Where do standard IAM controls fail in a Shadow AI breach?

A: They fail at the boundary where a legitimate login turns into delegated app access. MFA and password controls may still be intact, but they do not stop a valid OAuth token from being used after the app or endpoint is compromised. The weak point is consent and token lifecycle governance.

Q: Should organisations manage OAuth consent like privileged access?

A: Yes. High-risk OAuth permissions can expose mail, files, and tenant resources, so they should be handled with the same care as elevated access. That means limiting who can approve, tracking every grant, and reviewing the access lifecycle instead of treating consent as a one-time user choice.

Technical breakdown

OAuth consent becomes delegated access when the app is unapproved

OAuth is designed to let an application act on a user's behalf without sharing the user's password. That delegation is acceptable only when the app, scope, and governance are known. In the Vercel case, an employee granted broad permissions to an external AI tool with no IT review or contractual relationship, so the app inherited user-level trust inside Google Workspace. Once consent exists, the risk is not the login event itself but the scope of delegated access that follows the token.

Practical implication: treat OAuth consent as a privileged trust decision and govern which apps can receive enterprise-wide permissions.

Stolen OAuth tokens outlive the point of compromise

OAuth tokens are bearer credentials, which means possession is enough to use them until they expire or are revoked. The article describes a Lumma Stealer infection on a Context.ai endpoint that exposed the token, after which the attacker used it to access Google Workspace and Vercel systems. This is a classic identity handoff failure: the token remains valid even after the original endpoint or vendor environment is known to be compromised.

Practical implication: build token revocation and consent review into incident response, not just endpoint containment.

Shadow AI turns SaaS integrations into an identity graph

Shadow AI is not just unsanctioned software. It is a set of hidden identity relationships spanning users, apps, tokens, data, and connected SaaS tenants. When visibility is missing, security teams cannot see which app owns which permissions, whether access is still needed, or where data can flow next. The article's emphasis on Google Workspace, internal systems, and environment variables shows that the real control gap is the ungoverned permission chain, not a single endpoint failure.

Practical implication: inventory SaaS-to-SaaS connections and map permissions to the data and systems they can actually reach.

Threat narrative

Attacker objective: The attacker aimed to pivot from a third-party token into enterprise data access and then monetise the stolen information.

1. Entry occurred when an employee approved an unvetted AI application through their work Google account and granted broad OAuth permissions.
2. Credential access followed when a Lumma Stealer infection on the third-party endpoint exposed the OAuth token.
3. Escalation occurred when the attacker used the valid token to access Google Workspace, move into internal systems, and list environment variables.
4. Impact followed when stolen data was posted on BreachForums for $2 million, extending the breach into public exposure.

Breaches seen in the wild

• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is a governance problem before it is a technology problem. The Vercel case shows that an unapproved AI tool can enter the environment through ordinary employee behaviour and still create enterprise-grade identity risk. Traditional SaaS governance assumes approved software, known contracts, and visible owners, but shadow integrations bypass all three. The practitioner conclusion is simple: if the tool is invisible, its permissions are unmanaged.

OAuth consent is the new control plane for third-party access abuse. A broad consent screen can turn a casual user click into delegated enterprise access with the same reach as the employee's own identity. That makes permission scope, app approval, and revocation lifecycle central identity controls rather than administrative afterthoughts. Security teams need to treat consent as part of access governance, not just application onboarding.

Shadow AI expands the identity attack surface beyond human login events. The breach did not depend on password theft or MFA failure, which is why user-centric controls alone do not close the gap. The real exposure sat in the chain between an employee account, a third-party AI app, and the token that remained valid after the environment was compromised. The practitioner takeaway is that identity governance must follow the permission chain, not just the person.

Ephemeral credential trust debt: This article exposes the assumption that delegated access is easy to govern because the original user can always be identified. That assumption fails when a third-party AI app inherits access, the token is stolen off-platform, and the resulting activity is detached from the employee's direct intent. The implication is that governance models must account for delegated access that outlives the approval moment.

Identity visibility has become a prerequisite for breach containment. Josys' analysis reinforces a broader field-level lesson: organisations cannot investigate or revoke what they cannot inventory. In shadow AI environments, the control boundary is not the endpoint but the set of live SaaS relationships, token grants, and third-party scopes. Practitioners should treat visibility into connected identities as a foundational control for both NHI and SaaS governance.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

Ephemeral credential trust debt: When a third-party AI app receives broad OAuth consent, the organisation inherits a live trust relationship that can survive the original approval moment and even a downstream vendor compromise. That is why Shadow AI belongs in identity governance, not just SaaS procurement.

Security teams should focus on the connected identity graph, not only the human user who clicked approve. The real exposure sits in the path from employee account to third-party token to internal data, which means visibility, scope review, and revocation are the practical controls that change outcomes.

For practitioners

• Inventory unapproved AI integrations Identify every AI tool connected through work accounts, browser extensions, and SaaS consent flows, then classify whether each one has an owner, contract, and approved business purpose.
• Review OAuth grants by scope and tenant Pull the current OAuth app inventory, sort by delegated permissions, and flag any app that can read mail, files, tokens, or environment data without explicit business approval.
• Revoke tokens after third-party compromise Add consent revocation to incident response so that a compromised vendor endpoint cannot keep using a still-valid OAuth token while containment is in progress.
• Map SaaS-to-SaaS permission chains Document which third-party apps can reach Google Workspace, code repositories, or internal systems, and tie each path to a named business owner for periodic review.
• Block broad consent for high-risk scopes Require admin approval for apps that request wide-read or write access, especially where the request touches mail, files, identity data, or environment variables.

Key takeaways

• Shadow AI creates a blind spot when employee-approved integrations receive enterprise access without IT review or contract control.
• The Vercel case shows that a valid OAuth token can move a breach from a third-party app into core SaaS and internal systems.
• The decisive control is governance over consent, scope, and revocation across the permission chain, not just endpoint protection.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• OAuth Consent: The approval that allows an application to access resources on behalf of a user or tenant. In practice, consent can create durable access paths that outlive the original interaction if permissions are broad, unmanaged, or never reviewed. For security teams, it is both an access decision and a lifecycle event.
• Bearer Token: A bearer token is a credential that grants access to whoever possesses it, without requiring strong proof that the holder is the intended client. In NHI environments, that makes theft and replay the main risk, especially when tokens are long-lived, broadly scoped, or stored in local files.
• Permission Chain: The sequence of delegated rights created when one system authorises another, which then authorises or calls additional systems. As chains lengthen, the practical blast radius increases, and governance has to track end-to-end use rather than a single initial grant.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI programme, it is worth exploring.