Learning from the Vercel breach: Shadow AI & OAuth sprawl

<p>The Vercel breach wasn't some zero-day masterpiece. An employee clicked "Allow" on an OAuth prompt — the same button you and I mash dozens of times a month without reading a

<p>The rapid adoption of AI productivity tools is exposing a dangerous blind spot in enterprise security architecture. Organizations invest heavily in firewalls, SSO, and MFA not

<p>A Vercel employee signed up for an AI tool. They clicked Allow All on the OAuth consent screen. Three weeks later, customer environment variables were sitting on a hacker's

<p>On April 19, 2026, Vercel confirmed a security incident involving unauthorized access to their internal systems. The breach originated through a compromised third-party AI tool

<a href="https://news.ycombinator.com/item?id=47851634">Comments</a>