Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

161–170 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#161

Post by darkwater »

darkwater wrote: post #126
fg137 wrote: post #110

Earlier quoted context omitted.

Do we actually know the employee downloaded it on their work machine? At least this article doesn't say that (and I couldn't find it in other sources as well). Plenty of companies allow you to VPN into corporate network, or log into certain internal systems from the public Internet. Not saying they should, but it is much more common than you think. For reference, look at how Disney got hacked. One employee downloaded…

Actually, you are right to question this. TFA mentions a MicroTrend report [1] as his source, but that report doesn't mention Roblox cheats and more interestingly says that Context.ai employee machine was compromised 22 months ago, in 2024! While TFA says February 2026. This details makes me doubt about the whole article [1] https://www.trendmicro.com/en_us/research/26/d/vercel-breach...

TrendMicro, not MicroTrend ^^;;

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#162

Post by junto »

yoaviram wrote: post #12

I believe this is inaccurate. Vercel env vars are all encrypted at rest (on their side). The 'sensitive' checkbox means you can't retrieve the value once it's set, which would have saved your ass in this case. Also, annoying to read an article like this without a single link to source material.

They have an interesting UI decision here. The environmental variables list look like they are passwords (masked with a view button) and the sensitive flag is obvious in the add blade after you read the advisory but not before. We are busy rotating secrets because they were not marked as sensitive.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#164

Post by jeremie_strand »

maplethorpe wrote: post #159
cyanydeez wrote: post #92

Earlier quoted context omitted.

Right, and adding the shifting sands of AI security just makes it worse. AI isn't a technology that's improving security.

Once Mythos is available to business customers, it should radically improve security across the entire web. Imagine if everyone was able to pipe their codebase through Mythos before deployment. We honestly may be on the verge of a bug-free internet.

[dead]

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#165

Post by apgwoz »

kstrauser wrote: post #160
apgwoz wrote: post #141

Earlier quoted context omitted.

You’re thinking too much. When you run the app, the system decrypts the secrets and makes them available as env vars (or some other mechanism). In an admin ui, you list the names of secrets only, and provide a “reveal” or a “replace” on each one. They are never decrypted unless explicitly asked for. Is this perfect? Absolutely not. The key is controlled by the company, but it can be derived in a manner that doesn’t a…

My understanding is this is exactly how Vercel works. The users hadn’t checked the “don’t ever reveal, even to me” box next to the sensitive values. If they had, the attacker would only have been able to see the names of the variables and not their values.

Ah. The article has since been updated to point out that it’s not plaintext, but encrypted at rest (which would be expected). OK.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#166

Post by sandeepkd »

I read the original article, then the detailed statement and then this article to better understand what happened. I might consider myself as some one who has fairly good understanding of security flows. Here is my take:

1. The security flows are half baked and custom implemented, they do not present a coherent story

2. No one fully understands the ecosystem as a whole and so far no one has been able to track what actually happened, adding audit logs were not part of the product ask so no one ever added them in thoroughness

If I have to put my money then its the second one. The possible down the road action, at the most this incident would trigger more security engineers to be hired which may give the impression of improving things but in reality its probably going to create more blindspots where product engineers would hand out the responsibility to security engineers and they do not have much of an idea about the product flows

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#167

Post by tracker1 »

nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

I usually pay pretty close attention if something wants more than my email address, name and profile image, etc... I've used a couple things that request drive access, only because they actually deal with documents. I'm not sure that I've given any AI agents particularly open access... though if Claude Code wanted to, it could probably pwn me... I've been considering shifting to a VM for that.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#168

Post by redsocksfan45 »

darkwater wrote: post #49

I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…

[dead]

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#169

Post by GorbachevyChase »

StilesCrisis wrote: post #104
ethin wrote: post #5

This looks really really AI-generated even if the author did try to hide it by making some grammar elements improper. Idk if that diminishes it's accuracy though.

I had to stop reading. I have become overly sensitive to LLMisms. This is definitely "ChatGPT, read this article and rewrite it in a casual tone" with little to no actual authorship. On HN we should try to get primary sources for this sort of thing.

If it’s not important enough to deserve thought in writing, it’s definitely not important enough to read.
Post reply on HN