Writing
Anatomy of an Identity Incident

The AI Tool You Connected and Forgot

Anatomy of an Identity Incident — Vercel, April 2026. An OAuth token an employee granted to an AI tool months earlier, sitting forgotten, became the way in after the AI vendor got infected.

Michael AbramovichApril 30, 20266 min read

Forensic write-ups of public identity breaches, strictly at the identity layer. No vendor is the villain — the point is the structural class of failure, not the logo on it.

The 60-second version

In April 2026, Vercel disclosed unauthorized access to part of its internal systems. The attacker did not break in. They logged in — using an OAuth token that a Vercel employee had granted, months earlier, to a third-party AI tool. That AI vendor had been infected by infostealer malware weeks before; the token came out in that infection. With it, the attacker pivoted into Vercel's internal admin tooling and issue trackers, and reached the encrypted environment-variable store that holds secrets for more than a million developer projects. A threat actor under the ShinyHunters name then listed the haul — databases, access keys, employee accounts, source code — for two million dollars.

The thing that opened the door was an authorization nobody was thinking about anymore: a token granted once, to a convenient AI tool, still valid, still trusted, still reachable through the security of a company two steps away.

The identity timeline

Only identity-relevant events.

  • Months before — A Vercel employee connects a third-party AI tool to internal systems and grants it an OAuth token. Routine, useful, and then forgotten — the token lives on with standing access.
  • February 2026 — The AI vendor is infected with infostealer malware. Among what the malware harvests is the OAuth token for the connection into Vercel.
  • A gap of about six weeks — The token sits in the attacker's hands. As with other supply-chain intrusions, the dwell time says the prize wasn't the AI vendor; it was what the token unlocked.
  • April 2026 — The attacker uses the OAuth token to authenticate into Vercel as the connected tool, then moves laterally into admin tooling and issue trackers.
  • The reach — They get to the encrypted environment-variable store backing more than a million projects — the place customers keep their own secrets and keys.
  • April 19, 2026 — Vercel discloses the incident; a ShinyHunters-branded actor advertises the stolen data for $2 million.

The pivot point

The pivot is a standing OAuth grant to an AI tool that outlived anyone's attention.

By now this series has a recurring villain, and here it is in its newest costume. A session token, a signing key, an integration's tokens, and now an AI tool's OAuth grant — all of them bearer credentials that represent completed trust and then persist, quietly, past the moment anyone is watching. The employee made a reasonable choice: connect a helpful AI tool, authorize it, move on. But that authorization minted a non-human identity with standing access into Vercel, and the safety of that identity now depended entirely on how well the AI vendor protected what it held. When the vendor got infected, the token was just sitting there — valid, unrotated, unmonitored, and trusted.

What sharpens this one is the kind of vendor. AI tools are being connected to everything right now, fast, often by individuals reaching for convenience, frequently without anyone cataloguing the grant. Each connection is an OAuth token into something that matters, handed to a young company whose own security is unknown. The pivot isn't novel in mechanism — it's a stolen token bypassing the login the way stolen tokens always do. It's novel in surface area: a brand-new, rapidly multiplying population of forgotten authorizations to AI vendors, any one of which is a door.

What would have caught it

Naming controls, not products.

Inventorying and governing AI-tool connections specifically. The grants going to AI tools right now are the least-tracked authorizations in most companies. Knowing which AI tools are connected, by whom, with what access, is the control that turns "a forgotten token" into "a token we'd have caught."

Short-lived, regularly rotated, and expiring OAuth grants. A token that aged for months is what made the six-week-old theft still useful. Grants that expire and rotate shrink the window in which a stolen one works.

Monitoring non-human identities for anomalous use. The connected tool authenticating from new infrastructure, or reaching admin tooling it had never touched, is detectable — if anyone watches application identities the way they watch people.

Segmentation so a connected tool can't reach the crown jewels. An AI tool's grant should not be a path to admin tooling and the secret store. Least privilege between a convenience integration and the environment-variable vault would have capped the damage.

Scrutiny of the vendor's own security before connecting. Connecting a tool inherits that vendor's posture. For young AI vendors moving fast, that diligence is exactly the part most likely to be skipped — and most likely to bite.

The last mile

I'll be direct about why this is the right note to end the recent run on: it is the last mile arriving exactly where the principles said it would.

The argument running through all of these write-ups is that the dangerous, ownerless ground sits past the edge of any product — and that as authentication for humans got strong, that ground would move to the identities that aren't human. Vercel is that prediction with a date on it. No human credential was the problem. The platform's authentication wasn't bypassed; it was satisfied, by a token the system was right to trust. The failure lived in the span between "an employee connected an AI tool" and "every non-human authorization into our systems — especially the ones going to fast-moving AI vendors — is inventoried, scoped, rotated, and watched." That span is owned by no product. It is day-2 governance of machine identity, and it is the work that the tooling does not do for you.

And the AI angle is not incidental; it is the acceleration. The thing automating the convenient side of the stack — connect this tool, grant this token, let the agent do the work — is moving faster than anyone's ability to govern what it connects. So the mile is not shrinking as the tools get smarter. It is lengthening, because every new AI integration is another standing authorization into something that matters, handed out faster than it's tracked. The owner of that mile is still missing. The attackers, as usual, found it first.

For defenders

Five things you can check this week.

  1. Inventory every AI-tool connection into your systems — who connected it, what it can reach, and what its OAuth grant allows. This is the surface attackers are mining now.
  2. Expire and rotate OAuth grants, so a token stolen from a vendor doesn't stay useful for months.
  3. Monitor connected tools for anomalous behavior — new infrastructure, new systems reached, bulk access.
  4. Segment integrations away from admin tooling and secret stores. A convenience tool should never be one hop from the crown jewels.
  5. Vet the vendor before you connect. When you authorize a tool, you adopt its security posture — especially true for young AI companies.

Built from public reporting and the parties' own disclosures; sources below.

Sources

#vercel #oauth #shadow-ai #supply-chain #nhi #last-mile