Founder, Dryx AI Security 🛡️ Creator of the AI Security Triad — patent pending. 6yr cybersecurity. Making AI agents security-aware.
Joined February 2026
- Tweets7
- Following16
- Followers3
- Likes7
The Vercel hack isn't an OAuth story. It's a shadow-AI story.
One employee signed up for an AI productivity tool with their work email. Clicked "Allow All" on the OAuth prompt.
That single click became the master key into Vercel's Google Workspace, three months later, when the AI tool was compromised.
The chain:
Feb 2026 — Context.ai employee infected with Lumma Stealer (via downloaded Roblox cheats, of all things). Credentials harvested.
Apr 2026 — Attacker uses the stolen OAuth token. Pivots into Vercel's plaintext env vars: API keys, DB creds, signing keys.
Hundreds of orgs downstream.
This is the AI supply chain pattern every dev should understand:
Broad OAuth granted → AI tool accumulates credentials → AI tool gets compromised → every credential becomes downstream blast radius.
Been building RootShield around exactly this pattern. Patent-pending. rootshield.ai
