Threatwire: Vercel Breach Highlights OAuth Risks as NIST Reprioritizes CVE Enrichment
· 11:16 · Watch on YouTube ↗
Summary
Threatwire covers a reported Vercel breach involving compromised OAuth tokens, AI model security testing, and NIST changes that prioritize CVE enrichment for selected vulnerabilities while moving the existing backlog to an unscheduled category.
Key points
- The transcript says a March 2026 security incident at context[.]ai led to unauthorized AWS access and compromised OAuth tokens; an attacker used a token to access a Vercel employee's Google Workspace account and then Vercel environments.
- Vercel CEO Guillermo Rauch said customer environment variables were encrypted at rest, only non-sensitive variables were compromised, and a small number of customers were affected.
- The host argues that OAuth permissions and shadow IT were central to the Vercel incident, while Rauch described the attack as significantly accelerated by AI.
- The AI Security Institute's testing found Claude Mythos succeeded on expert-level CTF tasks 73% of the time and averaged 22 of 32 steps in a corporate network attack simulation, completing it in three of 10 attempts.
- NIST will prioritize NVD enrichment for CVEs in CISA's Known Exploited Vulnerabilities Catalog, those affecting federal government software, and those affecting critical software. It will rely on numbering-authority severity scores instead of issuing official NVD scores.
- NIST moved CVEs awaiting enrichment into an unscheduled category amid rising submission volumes; the transcript reports a 263% increase in submissions from 2020 to 2025.
Article Details
- Topics
- [00:15] Vercel breach, compromised OAuth tokens, and access to Vercel environments
- [02:27] Context-aware AI, workplace data collection, and privacy concerns
- [05:23] AI Security Institute testing of Cloud Mythos cybersecurity capabilities
- [06:46] NIST changes to NVD CVE enrichment priorities and severity scoring
- [08:50] AI-generated vulnerability submissions and Cal.com’s planned move to closed source
- [09:48] Security-related product and research news, including identity checks, cryptanalysis, bug bounty support, and scam-ad detection
Vendors
CrowdStrikeThe transcript says context.ai used CrowdStrike to help remediate its security incident.GoogleGoogle Workspace was accessed through a compromised OAuth token in the Vercel incident; the transcript also says Gemini was used to analyze ads and remove scams.VercelVercel reported a breach in which an attacker used a compromised OAuth token to access an employee's Google Workspace account and Vercel environments.