People are calling the Vercel breach an AI hack. It wasn't. But the next one will be, and here's why.

Quick recap. Over the past few days, a Vercel employee had authorized Context ai (a third-party AI tool) to their Google Workspace via OAuth. Context ai's AWS got compromised, the stored OAuth tokens were stolen/replaced, and the attacker pivoted into the employee's Workspace, then into some Vercel internal systems. Mandiant and CrowdStrike were engaged.

Now the interesting bit. Context ai isn't a CRM or an email plugin. Its whole job is to let AI agents act on behalf of users across applications. So the real root cause wasn't "compromised third-party SaaS." It was a compromised AI agent's OAuth credentials.

That distinction matters a lot, because the same blueprint already works against every AI coding agent shipping today. Claude Code, Cursor, Windsurf, Copilot all talk to the outside world through MCP servers and OAuth-backed integrations. One grant to an agent covers source code, business apps, email, calendars, cloud CLIs, and the agent's own memory. One compromised token and the attacker inherits all of that in a single grab. A lot more valuable than Workspace on its own.

No CVE needed. No phishing needed. Just OAuth, doing what OAuth is supposed to do.

The open questions for me are: which agent gets hit first, which MCP, and how long before we read about it on a hacker forum. Also — what's the right mitigation here? Scoped-down per-session tokens? Short TTLs with re-auth on sensitive operations? Something at the MCP layer?

Curious what people are doing in practice.

[留言]

为什么值得关注

能改变理解方式，而不只是重复常识；有直接可用的方法、工具或操作价值；它提供了新的理解或解释，而不只是表面观点

来源：reddit，领域：tech，保留分：0.71