Vercel has disclosed that it has uncovered additional customer accounts impacted by a security incident connected to Context.ai, which previously enabled unauthorized access to its internal systems.

The company stated that the findings emerged after expanding its investigation to include new indicators of compromise, along with a deeper review of network activity logs and environment variable access events.

According to Vercel, some of the newly identified accounts show signs of earlier compromise that occurred independently of the current incident. These older breaches may have resulted from methods such as social engineering, malware infections, or other attack techniques. Affected users have been notified, although the company has not revealed the total number of impacted accounts.

The investigation initially traced the breach back to a compromise involving Context.ai, where an employee’s account was accessed after their Google Workspace credentials were taken over. This allowed attackers to move into Vercel’s systems and extract sensitive but non-critical configuration data.

Cybersecurity researchers further suggested that malware infections, including information-stealing tools, may have played a role in the attack chain, potentially exposing authentication tokens and access keys.

Vercel CEO Guillermo Rauch confirmed that the threat actor appears to have been active beyond the initial compromise and warned that malware distribution targeting developer accounts remains an ongoing risk.

The incident also raises concerns about the use of third-party AI tools and OAuth integrations within organizations, which can introduce security vulnerabilities if not properly monitored or approved.