Vercel Finds More Compromised Accounts in Context.ai-Linked Breach

Vercel discovers additional compromised customer accounts linked to a Context.ai-related security breach that exposed internal systems.

• •Context.ai employee infected with Lumma Stealer malware in February 2026 after searching for Roblox exploit scripts, serving as the origin point of the attack chain
• •Attackers gained control of a Vercel employee's Google Workspace account through the compromised Context.ai integration, then pivoted into Vercel infrastructure
• •From the compromised account, attackers enumerated and decrypted non-sensitive environment variables within Vercel systems
• •Vercel also uncovered separately compromised customer accounts from prior incidents potentially caused by social engineering or malware
• •Unauthorized use of Context.ai Office Suite (shadow AI) may have facilitated the initial compromise, though official sanctioning remains unclear