On April 19, Vercel disclosed that attackers had moved through its internal systems and pulled environment variables from customer projects — database credentials, API keys, signing secrets. Values that give you the keys to production. They didn't break Vercel. They didn't exploit a zero-day. They walked in through an AI tool an employee had connected to their work Google account.

Here's the chain: A Context.ai employee was infected with infostealer malware in February, exposing admin access to that company's OAuth infrastructure. By March, attackers held valid tokens for every user who had connected the tool. One worked at Vercel. They logged in through the corporate Google Workspace and started reading project secrets.

Three hops. Two months. One OAuth grant a developer made during a five-minute onboarding flow. The data is reportedly being sold on BreachForums for $2 million.

Why this isn't an AI story — it's a procurement story

The instinct is to file this under "AI security." Wrong frame.

Every AI productivity tool worth its valuation requires broad access to your data — your email to draft replies, your documents to generate content, your calendar to schedule meetings. The functionality requires the access. Which means every AI tool an employee connects to corporate identity creates a trust relationship structurally identical to your relationship with AWS or Microsoft. The vendor's security posture is now your security posture. But while AWS goes through your full vendor risk assessment, the AI tool an engineer connected after a Slack thread did not.

A March 2026 survey found 99.4 percent of CISOs experienced at least one SaaS or AI ecosystem security incident during 2025. Your inventory is almost certainly worse than you think.

What to do this quarter — not next

Five things for a CIO's desk Monday morning.

Run an OAuth audit, today. In Google Workspace, check the Admin Console's third-party app permissions. In Microsoft 365, enterprise application registrations. Filter for any app with broad scopes — Gmail, Drive, calendar, directory access. For every AI tool, ask one question: did IT provision this, or did an employee click "Allow"? The second category is your immediate exposure.

Revoke and re-provision. Tools authorized by individuals with broad scopes should be revoked. If genuinely business-critical, IT re-provisions through controlled channels with scopes restricted to what the tool requires.

Treat AI SaaS as a tier-one vendor category. Your vendor risk program distinguishes cloud providers from SaaS apps. Add a third tier for AI productivity tools holding persistent broad-scope access to corporate identity. Assessment should specifically cover OAuth scope minimization, token rotation, infostealer monitoring, and incident notification timelines.

Stop storing static secrets in plaintext. Vercel customers lost data because environment variables defaulted to readable storage. Audit where long-lived API keys and database credentials live. Where cloud-native alternatives exist — IAM roles, OIDC federation, runtime-fetched secrets — migrate. An ephemeral credential has a narrow exploitation window. A static one has months.

Subscribe to infostealer intelligence. Hudson Rock identified the Context.ai compromise more than a month before Vercel's disclosure. Detection wasn't the gap — the workflow connecting intelligence to action was. Cross-referencing infostealer alerts against your vendor list would have shortened this exposure by weeks.

The real shift

We've been telling boards the AI security conversation is about model behavior — hallucinations, prompt injection, agent runtime governance. Those things matter. But the breach pattern actually happening at scale is more mundane: AI tools sit in the middle of every employee's workflow and inherit the security posture of vendors most enterprises haven't assessed.

The procurement question isn't is this AI tool useful — it's do we trust this vendor's infrastructure as much as we trust our own. For most AI tools your employees have already connected, the honest answer is no.

Three hops. Two months. One OAuth grant. The next one is in progress somewhere — the only question is whether your inventory finds it before someone else does.