OAuth-Token Supply-Chain Compromise Enables Attacker Access to Google Workspace: The Vercel and Composio Breaches
OAuth-Token Supply-Chain Compromise Enables Attacker Access (TL-2026-2018), also tracked as The Vercel Breach, is a high-severity supply-chain compromise, first published 2026-08-14. It has no confirmed attribution, affects Vercel Vercel enterprise Google Workspace OAuth integration /, maps to 15 MITRE ATT&CK techniques (T1059, T1069.003, T1078.004), and is covered by 9 detection rules and 8 indicators of compromise.
Key facts for TL-2026-2018
- Threat ID
- TL-2026-2018
- Also known as
- The Vercel Breach, The Composio Breach, Composio May 2026 Security Incident
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-14
- Last reviewed
- 2026-08-14
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud-hosting, developer-tools, ai-platforms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in OAuth-Token Supply-Chain Compromise Enables Attacker Access
Malware and tooling: Lumma Stealer - S1213, Context.ai AI Office Suite
Material Security VP Rajan Kapoor documents a shift in Google Workspace attacks from password-based account takeover to OAuth-token-based intrusion, citing the Vercel breach (a Context.ai OAuth token pivoted into Vercel's Workspace via an over-scoped 'Allow All' grant) and the Composio breach (a stolen Gmail OAuth token used to intercept magic-link sign-in emails, escalate through an agentic monitoring tool, and reach a tool-execution sandbox) as concrete cases of this pattern. Both incidents show a stolen or over-granted OAuth token functioning as a long-lived, password-reset-resistant credential that lets an attacker read Gmail/Drive content and pivot laterally using in-mailbox secrets and password-reset links, behavior the article argues is largely indistinguishable from legitimate AI-agent activity.
How OAuth-Token Supply-Chain Compromise Enables Attacker Access works
This threat documents an emerging OAuth-token-centric attack pattern against Google Workspace tenants, evidenced by two disclosed 2026 supply-chain breaches. In the Vercel case, a Context.ai employee endpoint was infected with Lumma Stealer infostealer malware in February 2026 via a trojanized Roblox 'auto-farm' cheat download, exfiltrating Google Workspace, Supabase, Datadog, and Authkit credentials, including access to the shared support@context.ai account. Separately, a Vercel employee had signed up for Context.ai's 'AI Office Suite' using their Vercel enterprise Google account and granted the app 'Allow All' OAuth permissions against Vercel's enterprise Google Workspace. The attacker used the Context.ai foothold to pivot through this over-scoped grant into Vercel's internal Google Workspace, then enumerated and escalated access into internal Vercel systems, reading environment variables (API keys, tokens, database credentials) that had not been flagged as 'sensitive'. A threat actor using the ShinyHunters name claimed responsibility on BreachForums and demanded $2 million for the alleged data, but Google Threat Intelligence Group assessed the claimant as likely an imposter using an established group's name; no confirmed attribution exists. Vercel disclosed the breach April 20-21, 2026, worked with Mandiant, Microsoft, GitHub, npm, and Socket, found no evidence of compromised npm packages, and now defaults deployment environment variables to 'sensitive'.
In the Composio case, disclosed May 21, 2026, an attacker compromised a Composio employee's Gmail OAuth token, gaining inbox access sufficient to intercept magic-link sign-in emails. This let the attacker authenticate into an internal agentic monitoring tool used to watch for connector failures, then abuse that tool's broad permissions to reach an automated remediation system. The attacker registered malicious tool definitions inside Composio's tool-execution sandbox, achieving arbitrary code execution, then pivoted to an auxiliary credential cache and exfiltrated customer secrets to commercial VPN endpoints. Disclosed impact: roughly 5,241 API keys and 5,001 GitHub OAuth tokens (revoked as a precaution), plus roughly 12 Gmail tokens and smaller sets of tokens for Jira, Slack, HubSpot, Linear, Notion, Google Calendar, Vercel, Sentry, Google Drive, and Bitbucket. Composio has not disclosed what data the attacker actually accessed with the stolen tokens, and no threat actor has been publicly attributed.
The common thread Material Security highlights, and the reason this is filed as a distinct threat rather than a restatement of either breach: OAuth grants survive password resets, don't expire on their own, and are hard to observe at the activity layer — making attacker use of a stolen or over-scoped token functionally indistinguishable from an AI agent legitimately using the same grant to read email and Drive content and act on what it finds.
MITRE ATT&CK techniques used in TL-2026-2018
Execution
T1059 Command and Scripting Interpreter; T1204.002 Malicious File
Discovery
T1069.003 Cloud Groups; T1087.004 Cloud Account
stealth
Collection
T1114 Email Collection; T1213 Data from Information Repositories
Persistence
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Credential Access
T1528 Steal Application Access Token; T1555.003 Credentials from Web Browsers
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
lateral-movement
T1550.001 Application Access Token
Exfiltration
Affected products and versions in OAuth-Token Supply-Chain Compromise Enables Attacker Access
- Vercel — Vercel enterprise Google Workspace OAuth integration / environment variables
Vulnerable versions: Pre-April 2026 configuration where environment variables defaulted to non-sensitive status
Fixed in: Post-April 2026 update defaulting environment variables to 'sensitive' - Context.ai — AI Office Suite and companion Chrome extension
Vulnerable versions: Chrome extension ID omddlmnhcofjbnbflmjginpjjblphbgk (active until removal)
Fixed in: Extension removed from Chrome Web Store 2026-03-27 - Composio — Composio agentic integration platform (tool-execution sandbox, internal monitoring/remediation tooling)
Vulnerable versions: Sandbox and internal tooling prior to May 2026 remediation
Fixed in: Post-incident hardening and token revocation, May 2026
Remediation for OAuth-Token Supply-Chain Compromise Enables Attacker Access
Patches
- Vercel platform update defaulting environment variables to 'sensitive' status, released following the April 2026 disclosure
Immediate actions
- Revoke and rotate all OAuth grants and API keys/tokens tied to any recently added or unfamiliar third-party SaaS/AI integration in Google Workspace
- Audit and remove 'Allow All' / broad-scope OAuth consent grants issued by employees to third-party applications
- Rotate all environment variables, secrets, and credentials on deployment platforms (e.g., Vercel) that were not previously marked 'sensitive'/encrypted
- Force re-authentication and invalidate long-lived OAuth and session tokens for any account showing anomalous Workspace API activity
Workarounds
- Disable browser credential/session syncing on corporate endpoints to limit infostealer blast radius
- Redact password-reset links and require step-up verification for password-reset flows surfaced via email/Drive content
Longer-term hardening
- Implement default-deny OAuth consent policies in the Google Workspace admin console, requiring administrator approval for third-party app grants
- Deploy continuous OAuth-grant inventory and anomaly monitoring across all connected SaaS and AI-agent integrations, not just Google/Microsoft
- Adopt identity attack-path analysis to model how a single overpermissioned OAuth grant can chain across organizational boundaries (vendor to customer)
- Apply least-privilege scoping to AI-agent tool-execution sandboxes and monitoring/remediation automation to prevent malicious tool-definition abuse
- Mark all deployment-platform environment variables and secrets 'sensitive' by default
Weaknesses (CWE) in OAuth-Token Supply-Chain Compromise Enables Attacker Access
CWE-284, CWE-269, CWE-522
Timeline of OAuth-Token Supply-Chain Compromise Enables Attacker Access
- A Context.ai employee endpoint is infected with Lumma Stealer infostealer malware after downloading a trojanized Roblox 'auto-farm' cheat script, exfiltrating Google Workspace, Supabase, Datadog, and Authkit credentials.
- Context.ai identifies and blocks unauthorized AWS access resulting from the earlier credential theft.
- The Context.ai Chrome extension (ID omddlmnhcofjbnbflmjginpjjblphbgk) implicated in the OAuth compromise is removed from the Chrome Web Store.
- Vercel discloses that an attacker used a stolen Context.ai OAuth token, pivoted through a Vercel employee's 'Allow All' OAuth grant, to access internal Vercel systems and non-sensitive environment variables; ShinyHunters claims responsibility on BreachForums, later assessed as a likely imposter.
- SpecterOps and other researchers publish detailed identity-attack-path analyses of the Vercel/Context.ai OAuth pivot.
- Composio discloses a security incident in which an attacker used a compromised employee Gmail OAuth token to intercept magic-link sign-in emails, escalate through an agentic monitoring tool into a tool-execution sandbox, and exfiltrate roughly 5,241 API keys and 5,001 GitHub OAuth tokens.
- Composio's incident disclosure is updated with additional detail on the scope of affected tokens across Jira, Slack, HubSpot, Linear, Notion, Google Calendar, Vercel, Sentry, Google Drive, and Bitbucket integrations.
- Material Security VP Rajan Kapoor publishes analysis via BleepingComputer connecting the Vercel and Composio breaches as evidence of a broader shift to OAuth-token-based Google Workspace intrusions.
Sources cited for OAuth-Token Supply-Chain Compromise Enables Attacker Access
- The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI
- Vercel breached via compromised third-party AI tool
- Vercel Breach Analysis: How an OAuth Token Became an Identity Attack Path
- Unpacking the Vercel breach: Shadow AI and OAuth sprawl
- Vercel breach tied to Context AI hack exposes limited customer credentials
- AI cloud company Vercel breached after employee grants AI tool unrestricted access to Google Workspace
- Single token got Vercel hacked: 'Allow all' OAuth
- The Composio Breach: One Token, 10K Doors
- Composio May 2026 Security Incident
- Composio Security Incident: What Happened and What AI Agent Teams Should Do Now
Threats related to OAuth-Token Supply-Chain Compromise Enables Attacker Access
- Azure Credential Theft Campaign Exposes Millions of Enterprise Records at McDonald's, Vodafone, TCS
- Personal GitHub Repositories Are a Major Blind Spot for Corporate Secret Leaks (Wiz Research)
- "TheHatman" Azure/Entra Directory Exfiltration Campaign Exposes Millions of Employee Records at McDonald's, Vodafone, Kyndryl, TCS, HCL and Others
- Vercel April 2026 Security Incident — Context.ai OAuth Compromise Leads to Google Workspace Takeover and Customer Environment Variable Exposure
- Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Attack Paths (UNC6040/UNC6240/UNC6395/GRUB1/Storm-3138)
- Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal OAuth Tokens
Detection coverage for TL-2026-2018
As of 2026-08-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2018 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.