The attack sequence began upstream. An employee at Context.ai downloaded compromised scripts containing Lumma Stealer malware, which harvested corporate credentials, active browser session cookies, and stored OAuth tokens resident on the local machine.

In modern cloud architectures, valid OAuth tokens represent a pre-authenticated identity state. Because they act as bearer credentials, anyone possessing the token can query the authorized APIs. This grants attackers distinct operational advantages: the API requests originate from a legitimate OAuth client ID, interactive MFA is bypassed, and access remains valid until explicitly revoked.

The attacker extracted the Vercel employee’s active OAuth token from the breached vendor database and authenticated directly into that developer’s Vercel-issued corporate Google Workspace environment.

Because the target account belonged to a highly privileged developer, the corporate identity served as a stepping stone. Through federated single sign-on (SSO) configurations, the attacker reached internal management dashboards and employee records.

While initial underground claims by threat actors alleged a broad compromise of active code repositories, official engineering audits confirmed that core codebases remained untouched. The actual blast radius was contained to customer environment variables that were not marked as “sensitive.” Because default configurations left these variables unencrypted at rest, the attacker enumerated and read them, using the data to fuel an extortion campaign on BreachForums under the ShinyHunters persona.

Describing an incident like this purely as “token theft” overlooks the fundamental governance failure: an employee was allowed to establish an unmonitored identity relationship with a third-party application via an AI agent. Traditional enterprise security controls, like periodic, retrospective OAuth audits, fail because they detect risks only after the identity bridge has already been integrated and exploited.

To close this gap, security teams must move the enforcement point directly to the moment of adoption using proactive, browser-level access governance.

The true origin of Shadow AI is the employee’s browser. Organizations can deploy secure browser-based tools that observe application usage at the precise point of interaction.

When a user attempts to install an unvetted AI browser extension or click an OAuth consent screen using corporate credentials, the system intercepts the event in real time. It maps the destination domain to a known registry and verifies whether that platform belongs to the organization’s approved application ecosystem. If the application is unmapped or violates compliance profiles, it is classified as shadow usage.

Remediation requires inline access control. For high-risk requests, such as a consumer AI extension demanding broad workspace scopes, the system can automatically block the authentication workflow before a user ever reaches the third-party consent step.

Had inline login restrictions and access governance been present, the attack chain would have collapsed at its origin point:

• Step 1 (Adoption): The employee attempts to sign into an unvetted AI extension. Secure browser-based discovery records the interaction instantly, categorizing it as an unmapped tool.
• Step 2 (Analysis): The extension requests broad Google Workspace OAuth scopes. The internal risk engine flags the application as an unapproved, high-risk integration.
• Step 3 (Enforcement): The employee attempts to click “Allow All.” Login restrictions block the identity federation, ensuring the OAuth token is never generated.

Without the identity bridge, the AI vendor holds no corporate tokens, leaving an upstream attacker with no downstream pathway into the enterprise network.

The fundamental takeaway of modern cloud security is that the perimeter has shifted to the OAuth grant. Mitigating Shadow AI is not about restricting productivity, but recognizing that trusting a third-party application’s authorization state without internal oversight invites supply-chain pivoting. Security teams must implement continuous application access governance that operates inside the user’s browser to discover shadow tools, validate them against an approved ecosystem, and gate identity delegation before trust is ever established.