Vercel OAuth Breach, Alleged Mythos Access, SIEM Race and Three Defender Zero-Days
Summary
The weekly roundup covers Vercel’s OAuth-based compromise, unconfirmed claims of Mythos access, Lovable’s BOLA exposure, three Defender zero-days, agent security, and new detection guidance.
Key points
- The article reports that an attacker used a Vercel employee’s inherited Context.ai OAuth grant after a Context.ai employee was infected with Lumma Stealer, then accessed plaintext environment variables. Vercel engaged Mandiant and made environment variables sensitive by default.
- Discord users claimed they accessed Anthropic’s Mythos Preview using compromised contractor credentials. Anthropic said it found no evidence its systems were affected; an impersonator’s separate claim was called fabricated.
- A researcher found Lovable API calls could retrieve other users’ source code, chat histories, and database credentials. The article says the fix covered new projects but left older projects exposed.
- Three Microsoft Defender zero-days were disclosed: BlueHammer (CVE-2026-33825) was patched, while RedSun and UnDefend remained unpatched. Huntress reported BlueHammer exploitation and public proof-of-concept activity for the flaws.
- The article describes GitHub’s agentic-workflow safeguards, including secretless execution and a deterministic pipeline that checks agent outputs before they are committed.
- It offers detection guidance for OpenAI Enterprise audit logs and summarizes Microsoft hunting logic for DPRK-aligned actor Jasper Sleet across HR and collaboration services.
Article Details
- Event Type
- Cybersecurity news roundup covering a Vercel OAuth-based compromise, alleged third-party access to Anthropic’s Mythos Preview, a Lovable authorization exposure, and Microsoft Defender zero-days.
- Impact
- The Vercel compromise exposed plaintext environment variables and enabled token-based access; Vercel’s CEO said the threat actor appeared to be running a broader token-harvesting campaign, and Vercel reported no npm package tampering. Discord users reportedly accessed Anthropic’s Mythos Preview through a third-party contractor environment, but Anthropic said it found no evidence its own systems were impacted. A Lovable BOLA flaw exposed other users’ source code, chat histories, and database credentials; the reported fix did not cover legacy projects. BlueHammer exploitation was reported, and RedSun and UnDefend had public proof-of-concepts; only BlueHammer was patched at the time described.
MITRE ATT&CK
CVE
CVE-2026-21520Microsoft · Microsoft Copilot Studioð Capsule Security exits stealth with $7M — runtime trust layer for AI agents; disclosed ShareLeak (CVE-2026-21520) and PipeLeak alongside launchCVE-2026-33825Microsoft · Microsoft Defender Antimalware Platformðª Three MSFT Defender 0-days, two still unpatched — BlueHammer (CVE-2026-33825) patched, RedSun and UnDefend live with public PoCs and in-the-wild exploitation
People
@weezerOSINTResearcher who demonstrated that Lovable API calls could retrieve other users’ source code, chat histories, and database credentials.Austin LarsenGoogle TAG representative who described the claimant offering alleged Vercel internal data as likely an imposter.Chaotic EclipseResearcher who disclosed the BlueHammer, RedSun, and UnDefend Microsoft Defender zero-days and public proof-of-concepts.Dominic AlvieriSecurity researcher who called the ShinyHunters impersonator’s screenshots claiming access to Anthropic’s Mythos Preview fabricated.Guillermo RauchVercel CEO who said the threat actor appeared to be conducting a broader token-harvesting campaign beyond Context.ai.
Threat Actors
Malware
Vendors
Anthropicsecurity events, including the Vercel OAuth-based compromise that led to Lumma Stealer token abuse, Anthropic Mythos access allegations, Lovable’s BOLA exposure, and three Microsoft Defender zero-days.Capsule Securityð Capsule Security exits stealth with $7M — runtime trust layer for AI agents; disclosed ShareLeak (CVE-2026-21520) and PipeLeak alongside launchContext.aiVercel was breached after a Context.ai OAuth “Allow All” grant was abused, exposing plaintext environment variables and enabling token-based access.CyeraIndustry movement includes Cyera’s acquisition of Ryft and new AI-security entrants (Artemis, Spectrum, Capsule, Aikido) focused on agent runtime protection and detection engineering.GitHub𧱠GitHub’s agentic workflows threat model — assume the agent is compromised; secretless execution, safe-outputs pipeline, damage-containment over preventionLovableOAuth-based compromise that led to Lumma Stealer token abuse, Anthropic Mythos access allegations, Lovable’s BOLA exposure, and three Microsoft Defender zero-days.Microsoftto Lumma Stealer token abuse, Anthropic Mythos access allegations, Lovable’s BOLA exposure, and three Microsoft Defender zero-days.RyftIndustry movement includes Cyera’s acquisition of Ryft and new AI-security entrants (Artemis, Spectrum, Capsule, Aikido) focused on agent runtime protection and detection engineering.SalesforceSecurity leaders from Salesforce, Oscar Health, and many highly regarded folks you probably know.VercelDarwin Salazar’s The Cybersecurity Pulse covers this week’s major security events, including the Vercel OAuth-based compromise that led to Lumma Stealer token abuse, Anthropic Mythos access allegations, Lovable’s BOLA
Products
Claude Mythos PreviewPer TechCrunch, a group of Discord users claim to have gained unauthorized access to Anthropic’s Claude Mythos Preview on the same day it was announced, reportedly by combining compromised credentials from a third-partyGoogle WorkspaceA Vercel employee connected Context.ai’s AI Office Suite to their enterprise Google Workspace and granted “Allow All” permissions.LovableOAuth-based compromise that led to Lumma Stealer token abuse, Anthropic Mythos access allegations, Lovable’s BOLA exposure, and three Microsoft Defender zero-days.Microsoft Copilot StudioThe platform sits in the agent execution path and blocks unsafe tool calls, manipulation, and data exfiltration at runtime, with support for Cursor, Claude Code, Copilot Studio, ServiceNow, and Salesforce Agentforce.Microsoft Defender Antimalware PlatformLumma Stealer token abuse, Anthropic Mythos access allegations, Lovable’s BOLA exposure, and three Microsoft Defender zero-days.Salesforce AgentforceThe platform sits in the agent execution path and blocks unsafe tool calls, manipulation, and data exfiltration at runtime, with support for Cursor, Claude Code, Copilot Studio, ServiceNow, and Salesforce Agentforce.