Vercel's April incident now has a readable shape: a Context.ai compromise, a Vercel employee's Google Workspace OAuth grant, access to internal systems, and enumeration of non-sensitive environment variables. [1] Sunday's paper called the breach the AI OAuth supply-chain case study. Monday's update is plainer and worse. It is the warning label for AI agents as corporate identity infrastructure.

The official bulletin says the attacker used the Context.ai path to take over an individual Vercel Google Workspace account, pivoted into Vercel systems, and decrypted environment variables not marked sensitive. [1] Context.ai's own update describes compromised OAuth tokens and an "allow all" permissions grant for an AI Office Suite that could write emails or create documents on a user's behalf. [2] That is not a bug in a chatbot. It is delegated authority.

The divergence is useful. Mainstream security coverage explains the incident as a third-party breach that touched Vercel. [3] Security X reads it as the beginning of the AI-agent permission crisis: tools marketed as office assistants are accumulating the same practical reach as administrators, without appearing in ordinary login prompts or MFA rituals.

OAuth made modern SaaS pleasant. A user clicked a consent screen; a vendor received a token; work flowed between calendars, documents, deployments and source control. AI agents raise the stakes because the product promise is action. A passive analytics integration can read. An agent can read, draft, send, summarize, deploy, and route work through APIs that make the boundary between user and tool porous.

Vercel's bulletin shows the first governance rule: companies need an inventory of AI tools with Google Workspace scopes, not a vague list of approved vendors. They need revocation drills. They need default-deny policies for broad permissions. They need environment variables marked sensitive before the breach, not after it.

The story is not that Context.ai is uniquely dangerous. The story is that Context.ai is ordinary enough to be everywhere in miniature. Every AI agent asking to "connect your workspace" is also asking to become a security principal. Vercel turned that hidden bargain into a public incident.

-- MAYA CALLOWAY, New York