Neither OpenAI nor Anthropic will say whether Vercel is a customer of their new AI security products. The paper's Saturday standard on the Daybreak-and-Glasswing frame around Vercel names the shared partner rosters and the matched silence; Friday's piece on the Vercel OAuth incident as an AI supply-chain story named the breach path. The standing question is whether the products marketed to fix the path were sold to the company that needed them most.

OpenAI launched its Daybreak security initiative this week with Cisco, CrowdStrike, and Palo Alto Networks named as partners. [1] Anthropic's Project Glasswing carries the same three on its partner page and the same supply-chain framing in its launch material. [2] Vercel's own April bulletin describes a breach routed through a Context.ai OAuth grant into developer infrastructure. [3]

The three companies overlap on the marketing roster. None has said publicly whether Vercel sits on a customer list at either house. Press inquiries this week were declined or unanswered.

That silence is the artifact. A vendor that cannot answer a yes/no question about a named, public breach victim is telling the market what the product covers and what it does not. The Daybreak and Glasswing announcements both emphasize OAuth lineage and AI-app inventory — the precise category of the Vercel path. The customer answer would either validate the marketing or expose the gap. Neither vendor wants to be the one to publish the answer.

Until they do, the AI security stack remains a roster of logos, not a coverage map.

-- THEO KAPLAN, San Francisco