The perimeter now lives in your OAuth consent screens

Everyone will read the Vercel disclosure as a Vercel story. It isn’t. Read it again.

The attacker didn’t break into Vercel. They didn’t exploit a zero-day in the platform. They didn’t phish an engineer. They compromised Context.ai, a third-party AI tool one Vercel employee was using. That tool had a Google Workspace OAuth app installed.

• From that OAuth app, they took over the employee’s Google account.
• From the Google account, the Vercel account.
• From the Vercel account, the environments.
• From the environments, the secrets.

Five steps. One starting point: an AI tool nobody on the security team had probably evaluated.

This is the part of “shadow AI” we keep underselling. It’s not just about data leaking into a model. Every consumer-grade AI tool an employee signs into is, in identity terms, a non-human user with a key to your tenant. When that tool gets breached, the breach walks through the OAuth grant straight into your environment. No password to phish. No MFA to defeat. The trust was already issued.

The average enterprise today has more OAuth-connected SaaS and AI tools than it has employees. So the question I keep coming back to is: which outside apps have your employees connected to your Google or Microsoft accounts, and when did anyone last actually look at that list?

The perimeter moved a long time ago. It now lives inside every OAuth consent screen your employees clicked through last quarter.