In its April 23 update, Vercel disclosed customer accounts compromised prior to and independently of the Context.ai incident. Covering the Lumma Stealer infection path, the ShinyHunters $2M BreachForums listing, and what non-sensitive environment variables actually mean.
Vercel's official incident disclosure published on April 19, 2026. A walk-through of how a compromise of Context.ai's Google Workspace OAuth app led to Vercel employee account takeover and access to environment variables in some customer projects, plus the checks users should run right now.
On March 19, 2026, Anthropic took legal action against OpenCode to remove the OAuth integration. On the same day, Python toolchain Astral announced that it was joining OpenAI's Codex team. The formation of AI coding tools was activated in one day.
