Your developer toolchain became the attack surface this week

Vercel confirmed on April 19 that attackers reached production by compromising Context.ai, riding its OAuth grant into an employee's Google Workspace, and pivoting from there. A ShinyHunters-affiliated actor is now selling NPM tokens, GitHub tokens, API keys, source code, and 580 employee records for $2M. CEO Guillermo Rauch said the attackers moved with "surprising velocity and in-depth understanding" — his phrase, not mine — and attributed the speed to AI.

That's the story. Not because Vercel is uniquely exposed, but because the kill chain uses architecture every one of your engineers has already built into your environment. Someone on your team connected an AI observability or coding tool to Google Workspace or Entra ID in the last twelve months. Probably several someones. Each of those OAuth grants is the same attack path Context.ai was.

And it didn't arrive alone.

Five tools, five exploitation paths, same week

Anthropic's Model Context Protocol SDK ships with STDIO transport defaults that accept unsanitized commands. OX Security found 30+ vulnerabilities and 10 CVEs across 200+ open-source projects and thousands of deployed servers. This is a protocol-level design flaw, not a bug you patch. If you run MCP with defaults, you have RCE.

Cursor AI has an indirect prompt injection chain — call it NomShub — where a malicious README triggers the agent to open a remote tunnel, register a GitHub device code, and overwrite .zshenv for persistence. The trigger is opening the repo. No user action beyond that.

iTerm2's SSH conductor accepts DCS/OSC escape sequences from any terminal output. Trigger: cat readme.txt. The patch is described as unstable.

GitHub CI/CD's pull_request_target was abused across 500+ malicious PRs (the prt-scan campaign) running for three weeks before disclosure, compromising 106 package versions and exfiltrating AWS, Cloudflare, and Netlify credentials via /proc/*/environ. IOCs are specific: branches matching prt-scan-[12-hex], PR title "ci: update build configuration", user agent python-requests/2.32.5.

Protobuf.js — 52M+ weekly downloads, almost certainly a transitive dependency somewhere in your stack — shipped an RCE via malicious config file. Patched, but check.

Yes, but — someone will point out that most of these require specific triggers or configurations, and that mature teams already sandbox untrusted code. Fair. The problem is that the trigger for Cursor is opening a repo, the trigger for iTerm2 is displaying a file, and the trigger for the MCP vulnerabilities is the default configuration. Mature-team hygiene assumed a threat model where these actions were safe. That assumption is gone.

The economics under all of this

Claude Opus 4.6 produced a working Chrome V8 exploit chain targeting Discord's outdated Chromium 138 for $2,283 in API calls and twenty hours of guidance. Patch notes were the roadmap. Separately, a multi-institution team stripped Kimi K2.5's safety guardrails from 100% to 5% refusal for under $500 of compute in ten hours — the resulting model kept its capabilities and produced detailed CBRNE instructions. This isn't a jailbreak prompt you patch. It's a permanent weight modification.

Model-level safety is not a security control. It's a speed bump. Your defensive architecture needs to assume adversaries have uncensored frontier-class LLMs, because for $500 they do.

The patching window built around human exploit-development timelines — weeks to months from disclosure to weaponization — is gone. Assume hours to days.

What GitHub published this week is your new baseline

GitHub's Agentic Workflows security architecture is the most detailed public agent threat model from a major platform, and the design principle is unambiguous: agents never touch secrets, enforced by container topology, not policy. Every credential-bearing operation goes through sidecar proxies. Every write goes through a buffered pipeline that validates against allowlists, quantity caps (max 3 PRs per run), secret scans, and URL stripping. Every trust boundary is a logging point.

OpenAI's Codex converged on the same principle independently: secrets available only during setup, removed before agent execution, internet disabled by default. When two of the largest AI platform operators arrive at the same architecture without coordinating, that's the signal. Prompt injection is not solved. Design for containment.

If your agent architecture is less than ten times the size of your prompt layer, you're underinvesting in the harness. MBZUAI's teardown of Claude Code found 512K lines of infrastructure — 54 tools, 7 permission modes, 5 compression layers, 27 hooks — wrapping what is fundamentally a while-loop. That ratio is the production reality.

Do these three things this week

Rotate all secrets accessible through Vercel today. Environment variables, deployment tokens, database credentials, and especially the NPM and GitHub tokens the attacker is selling. Don't wait for Vercel's scope confirmation — their public language ("reportedly protected") is doing work you shouldn't rely on.

Audit third-party OAuth grants in Google Workspace (Security → API Controls → Third-Party App Access) and Entra ID (Enterprise Applications). Revoke anything not explicitly security-approved. Enforce admin approval for new grants via your IdP or CASB before Monday. This closes the Context.ai class of attack, not just the Context.ai instance.

Inventory MCP deployments, override STDIO defaults with explicit command allowlists, and restrict Cursor to vetted internal repositories with shell execution and tunnel creation disabled for external code review. If your team resists the Cursor restriction, show them the NomShub write-up — the persistence mechanism is a .zshenv overwrite that survives until someone manually finds the tunnel.

The compression is real. Exploit generation dropped 100x in cost, model safety comes off for $500, and the tools your developers adopted for velocity are the same tools attackers adopted for access. The correct response is not to slow down adoption — that ship sailed. The correct response is to assume every agent in your environment is one crafted input away from compromise, and to make that assumption boring by containing what a compromised agent can actually reach.