Vercel's infrastructure was breached after an attacker compromised Context.ai, an AI tool that an employee had connected to their corporate Google Workspace account with overly broad permissions. The attacker stole non-sensitive environment variables and API keys and is demanding $2 million for the stolen data. The attack chain began months earlier when a Context.ai employee was infected with Lumma Stealer malware from downloading Roblox cheat scripts. Vercel says sensitive variables encrypted at rest were not accessed, and has advised customers to rotate any API keys or credentials stored in non-sensitive environment variables.