Recommended reading

Vercel shows how an AI tool can become a path into internal systems.

Vercel disclosed that attackers reached part of its internal environment after compromising a third-party AI tool and abusing broad Google Workspace OAuth access granted by an employee. The case matters because it shifts the conversation from model risk in the abstract to a very concrete issue: delegated AI tooling with excessive permissions can become a lateral-movement path into engineering systems.