Big news: Can AI remember what you told it yesterday? 🤔 Frontier ML dives into the cutting edge of AI context memory, exploring how systems are learning to recall past interactions reliably and securely. This is a huge step towards more natural and helpful AI, but it raises critical questions about privacy and trust. What do you think? #AI #ArtificialIntelligence #ContextAI #MachineLearning

CYFIRMA’s report shows how identity compromise, delegated SaaS access, agentic infrastructure, and data-theft objectives can combine into composable attack surfaces across cases like Vercel/Context.ai, Salesloft/Drift, Taiwan, and EchoLeak. It emphasizes that the Policy/Authorization Control Plane and non-human identity governance are high-leverage defenses, while standards such as AIMS and Cross App Access are emerging to close the gap. #Vercel #Contextai #Salesloft #Drift #EchoLeak #AIMS #CrossAppAccess

A 17-year-old vulnerability in Microsoft Excel, tracked as CVE-2026-23456, remains actively exploited in targeted attacks, allowing arbitrary code execution via maliciously crafted spreadsheet files. The flaw affects all Excel versions from 2007 to 2026 and was disclosed by security firm Check Point Research on April 20, 2026. Context.ai inadvertently exposed Vercel API keys and internal credentials in a public GitHub repository, leading to unauthorized access to cloud infrastructure before the leak was remediated on April 19. The NSA confirmed it continues to use the Mythos cybersecurity framework despite its ban under Executive Order 14028, citing "mission-critical" dependencies, though no specific operational details were disclosed. No additional CVEs or patch release dates were provided for the Excel or Mythos-related issues.

Unapproved AI apps can create persistent OAuth bridges between enterprise platforms and third-party services, and when those providers are compromised attackers can pivot into corporate environments. The Vercel incident involving Context.ai illustrates how shadow AI integrations and widespread OAuth sprawl across SaaS amplify risk and demand tighter consent controls and browser-level visibility. #Vercel #ContextAI

In March 2026, Context.ai experienced a security breach leading to unauthorized AWS access, which subsequently compromised OAuth tokens for some users, including Vercel. Attackers exploited a compromised OAuth token from Context.ai to access Vercel's Google Workspace, exposing environment variables—though Vercel stated only non-sensitive variables were affected and encryption at rest remained intact. The incident highlighted issues with OAuth management, shadow IT, and third-party token sprawl, with Vercel's CEO attributing the attack's acceleration to AI, though critics argued it stemmed from poor security practices. Separately, the UK's AI Security Institute tested Claude Mythos, finding it completed 73% of expert-level CTF challenges and averaged 22 out of 32 steps in a corporate network attack simulation, outperforming prior models. NIST announced changes to the NVD program, deprioritizing CVE enrichment due to a 263% surge in submissions since 2020, now focusing only on critical vulnerabilities, federal software, or those in CISA's exploited catalog. OpenAI released a cybersecurity-focused model on April 14, 2026, while companies like Cal.com cited AI security concerns as a reason to transition from open to closed source. Additional updates included Google removing 602 million scam ads using Gemini AI and Trail of Bits bypassing Google's zero-knowledge proof for quantum crypto analysis.

Daily Recap, Bitwarden and Checkmarx faced separate supply-chain compromises that exposed developer secrets through malicious npm, Docker, and extension loaders affecting CLI, KICS, VS Code, and Open VSX users. Vercel disclosed broader fallout from a Context.ai intrusion, with Lumma Stealer stealing API keys and tokens that could impact downstream systems. #Bitwarden #Checkmarx #ContextAI #LummaStealer #Vercel

Vercel said ongoing analysis found the fallout from an attack on its internal systems affected more customers than previously known, with a “small number” of accounts impacted and investigations uncovering additional evidence of compromise. The incident originated at third‑party Context.ai, involved Lumma Stealer and the theft of API keys/tokens used to enumerate environment variables, creating potentially large downstream risk. #Vercel #LummaStealer

The Reddit post references an analysis of a Vercel OAuth breach involving a compromise of Context.ai. The incident is linked to a **MITRE T1199 trust-chain attack**, where adversaries exploited trusted relationships. Indicators of Compromise (IOCs) are provided for Google Workspace administrators to detect related malicious activity.

Context deploys agents inside your enterprise systems. They execute real workflows, learn from your team's corrections, and measurably improve.

Vercel confirmed a data breach linked to Context.ai, a third-party service provider, after a hacker listed alleged stolen data for sale at $2 million. The threat actor claimed the compromised data includes internal Vercel systems and customer information, though specifics on the volume or exact nature of the data were not disclosed. ShinyHunters, a known cybercriminal group, publicly denied involvement in the breach and warned of imposters falsely claiming responsibility. No technical details, such as attack vectors or CVE identifiers, were provided in the report. The incident highlights risks associated with third-party integrations in cloud-based development platforms. The breach's timeline and full impact remain unverified by independent sources.

A popular cloud platform, Vercel, suffered a breach traced to a compromised third-party AI tool, Context.ai, which allowed attackers to access an employee's Google Workspace account and some non-sensitive environment variables. Vercel is investigating with Mandiant and law enforcement, has warned affected customers to rotate credentials, and cautioned that deleting projects or accounts does not remove all risk. #Vercel #ContextAI

Vercel suffered a security breach after a third-party AI tool compromise (Context.ai) allowed attackers to hijack a Vercel employee’s Google Workspace account and access some internal environments and environment variables. A limited subset of customers had credentials compromised, and Vercel has notified affected users, advised rotating secrets, engaged Google Mandiant and other experts, and deployed additional protections. #Vercel #ContextAI #GoogleWorkspace #ShinyHunters #BreachForums #NextJS #Turbopack

Vercel acknowledged a security breach linked to Context.ai that resulted in the exposure of customer environment variables. The threat actor ShinyHunters listed the stolen data for sale on BreachForums for $2 million. The incident involved unauthorized access to sensitive configuration details.

Infrastructure provider Vercel disclosed a significant security incident, stemming from a compromise of the third-party AI tool Contextai. A highly

Vercel confirms a breach linked to Context.ai, while a hacker lists alleged data for $2M. ShinyHunters denies involvement in the incident.

Context deploys agents inside your enterprise systems. They execute real workflows, learn from your team's corrections, and measurably improve.

A Reddit post links the Vercel breach to an infostealer malware infection at Context.ai. The post references an external article reporting the connection between the two incidents. No additional details about the breach or infection are provided in the post itself.