Last week, Vercel disclosed a security incident that quietly rewrote the threat model for every engineering organization deploying AI tools. The breach entry point wasn't a zero-day. It wasn't a phishing campaign or a misconfigured S3 bucket.
It was a third-party AI tool — Context.ai — whose employee was infected by Lumma Stealer malware. The stolen credentials included Google Workspace OAuth toke