Two AI-adjacent supply chain breaches in three days. Both targeted developer tooling credentials. Both came in through tools marketed at people who don't run security teams. Both are about to be dismissed as "another supply chain attack" by people who should know better.
The breach pattern that scares me most isn't the one with the highest blast radius. It's the one where the people getting hurt don't know what got leaked, much less what to do about it. That's this past week.
Two breaches, one pattern
On April 19, Vercel disclosed that customer data was stolen via a breach at Context AI, an AI tool used internally by a Vercel employee. The actual entry point was a Lumma Stealer infection on a Context.ai employee's laptop in February. The infostealer arrived through a Roblox auto-farm script downloaded on personal time. From there, it harvested the OAuth credentials linking Context.ai into Vercel's Google Workspace. Attackers walked from a stolen Workspace token to enumerating Vercel project environment variables, where the live keys live. The leaked database is currently listed on BreachForums for two million dollars.
Three days later, on April 22, the Bitwarden CLI shipped a malicious npm package for ninety minutes. The vector was the Checkmarx supply chain attack, specifically the checkmarx/ast-github-action artifact that Bitwarden's CI pipeline relies on. The payload was loud. Three things stood out: a multi-cloud credential harvester for AWS, Azure, and GCP, a self-propagating npm worm that re-infects every package the victim's token can publish, and one specific module built for one specific job. That module went hunting for credentials from authenticated AI coding assistants. Bitwarden caught it fast, and end-user vault data wasn't impacted, but 334 CI runners and the developer tokens on them are exactly the kind of access this campaign was after.
This is the third major incarnation of the attack family the security community now calls Shai-Hulud. It isn't theoretical. It is recurring. And it's now shipping AI-coding-tool-specific payloads as standard equipment.
Who actually gets hurt
The temptation is to read both stories as enterprise supply chain incidents. They are. The more uncomfortable fact is who the affected population really is.
Vercel sells itself as an "instant deployment platform" so you can ship from git in one click. The marketing works, and it works well. The customer base is full of professional developers. It's also full of weekend builders, prototypers, and people who don't know what an OAuth scope is. Imagine a real estate agent who can barely use their phone, vibe codes a side project on Saturday, and pushes it to Vercel by Sunday. With the breach in this past week, that real estate agent has just handed an attacker their code, their live API keys, and the production credentials to whatever payment processor or CRM they wired in. They won't see a generic incident notice and know what to do. They won't know what to rotate. They might not even know they're affected.
That's the population the AI-builder-tooling movement was sold to. Anybody can ship now. The pitch is true. So is the consequence.
A dinghy in open seas
Here's the metaphor that captures it. The non-technical builder is a dinghy in open seas. No plan, no skill, no understanding of the actual requirements. Just a person in something that's technically a boat, hoping to make it, and not seeing the danger until it's far too late.
In the actual ocean, we have the Coast Guard. We have weather services, distress channels, and mandatory life-vest rules. We have a culture that treats unsafe operation as a public risk. In tech, we have none of that. We have a marketing arms race that tells anyone with a credit card they can launch.
That has to change. The responsibility isn't evenly distributed.
TO BLEEDING-EDGE VENDORS
You carry the heaviest weight, by a wide margin. You stopped being the scrappy startup the brand deck still talks about. You are a privileged identity provider in your customers' environments. Fund your security like that's true.
Two specific changes. First, treat secure-by-default as a roadmap line item with the same priority as a feature ship. The Checkmarx-into-Bitwarden chain only worked because a third-party CI artifact had production-grade write access to a security-critical npm package. That's a configuration choice, and you can change it.
Second, your breach notification practice has to be 100x better than it is now. A press release isn't a notification. A blog post isn't a notification. A notification is a named message to each affected customer that says exactly what got exposed, exactly what to rotate, and exactly how to do it from whatever device they have. If you can't ship that, you don't yet understand the responsibility you took on the day a non-technical user trusted you.
TO ENTERPRISES
Your developers are wiring AI tools into production whether or not you sanctioned them. The Vercel-via-Context-AI chain ran through an OAuth scope into a Google Workspace, exactly the kind of integration that gets approved on a Slack message. Treat every one of those tools like a privileged service account. Audit the scope, log the access, and rotate the tokens on a schedule. Assume the next infostealer will land at a vendor whose name you haven't heard yet.
If you have AI coding assistants in production, assume the credentials they hold are now the prize. Plan accordingly.
TO THE DINGHIES
You aren't the cause of this. The lack of a coast guard is. And you can't wait for one. Three things, today.
Turn on two-factor authentication on every account that supports it. Get off any tool that won't let you rotate API keys from your phone, because if you can't rotate from your phone, you can't rotate during the next breach. Sign up for haveibeenpwned.com so you find out you were affected when the data leaks, not when it shows up in a fraud report.
They are the life vest.
The community owns this
The vendors carry most of the weight. The enterprises carry their share. The non-technical builders carry the rest. The analysts, the talking heads, and the regulators in this industry have a job too. We've spent a decade telling people that anyone can ship. That was true. We didn't spend the same decade telling them what would happen if they did. That's on us.
Tech has no coast guard. Vendors carry the weight to build one. The community has to demand they do.
---