Feels like the bigger issue here is how much implicit trust we’re starting to place in these AI-integrated workflows. Tools that sit in the middle (like Context.ai) end up becoming a pretty large attack surface without feeling like one.
[dead]
A Roblox cheat and one AI tool brought down Vercel's platform
121–130 of 186 posts
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#122Ok but how do you go from a Google Workspace to production env vars? Doesn’t Vercel use 2FA? Did the hackers also get the env vars encryption keys?
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#123[flagged]
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#124"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry."
Do other (tech-literate) people do this?! Giving anything access to my emails and Google Drive would keep me up at night and I try and be very granular with permissions and revoke them when I don't use an app any more. I would assume that anything confidential/NDA in my emails had been compromised and leaked well before this point!
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#125[deleted]
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#126I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…
Do we actually know the employee downloaded it on their work machine? At least this article doesn't say that (and I couldn't find it in other sources as well). Plenty of companies allow you to VPN into corporate network, or log into certain internal systems from the public Internet. Not saying they should, but it is much more common than you think. For reference, look at how Disney got hacked. One employee downloaded…
Actually, you are right to question this. TFA mentions a MicroTrend report [1] as his source, but that report doesn't mention Roblox cheats and more interestingly says that Context.ai employee machine was compromised 22 months ago, in 2024! While TFA says February 2026. This details makes me doubt about the whole article
[1] https://www.trendmicro.com/en_us/research/26/d/vercel-breach...
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#127I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…
That’s one among a dozen factors at play here. Yes that’s bad, but also the security of other systems should never depend on your work laptop never getting hacked or having spyware installed. If that’s the only defense, you’re going to have problems.
I know and understand, but still, if the claim is factually true - and now I'm doubting, that's basic security hygiene that everyone working in a software company should be required to know before getting hired.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#128Earlier quoted context omitted.
Right? This isn't "A Roblox cheat and an AI tool", this is a failure of basic basic basic opsec across two organisations. One for which the Context.ai employee needs to have their arse booted up and down the car park for.
What about the context.ai security team? You can blame individuals, but security is a property of the system.
The bootings will continue until the fuckups improve.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#129I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…
I totally agree with your post.
> ... what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine ...
And if we think just a tiny, tiny, bit about this the entire concept of a laptop that's both used at work and outside work for non-work related things is already quite a stretch.
I could name one company that is top 10 in market cap in the world where engineers had, on their desk (or below it), a work computer that was not connected to the Internet (but fully connected to an internal network) and a second computer, on another network, that was connected to the Internet. They may still have that setup today: don't know.
FWIW my main "workstation" (it doesn't have ECC memory and, weirdly enough, the actual workstation here is... a Proxmox server) doesn't even have sound.
No sound.
Ask yourself this: can you work without your main work computer even have the ability to emit any sound? For most people it's yes.
And I'm no luddite: countless NUCs, Pi's (got a tower of stacked Raspberry Pi's), laptops, etc.
But I don't need to watch Youtube vids on my main work computer. And I certainly don't need to play games on it.
Conf call? There are laptops for that.
Youtube vids? Just watched several from Clojure/Conj 2025 these last days. From one of the laptops.
The very idea that you game on the laptop that you bring to the coffee shop that you bring at work is what brought down Vercel. And shall take down many others.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#130"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…
> Do other (tech-literate) people do this?!
I'm sure it's very common, yes. Permissions & popup fatigue is very real. Today, every application and website throws 6 dozen popups at you that you have to get through to get to the stuff you came there for. Most of it is marketing; some of it is from braindead lawyers; some of it is important; none of it gets read by users. At some point you give up and just click "yes, goddamnit, I have work to do" and all the security stuff is out the window.
Always remember: there is no such thing as computer security. If your data is on a networked computer, consider it to be semi-public. The first and only rule of computer security is don't store or do anything on a networked computer that would devastate you if it were leaked or compromised
And, make sure not to think about how much of our modern infrastructure is built on top of computers connected to the Internet.