--- title: Vercel breach traced to OAuth chain, MCP STDIO flaw hits... description: A compromised Context.ai employee device triggered an OAuth credential chain that reached Vercel's internal systems, exposing environment variables and... canonical: https://daily.dev/posts/vercel-breach-traced-to-oauth-chain-mcp-stdio-flaw-hits-200k-servers-bxrn1ysmu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Vercel breach traced to OAuth chain, MCP STDIO flaw hits 200K servers | daily.dev og:description: A compromised Context.ai employee device triggered an OAuth credential chain that reached Vercel's internal systems, exposing environment variables and... og:url: https://daily.dev/posts/vercel-breach-traced-to-oauth-chain-mcp-stdio-flaw-hits-200k-servers-bxrn1ysmu og:image: https://api.daily.dev/og/posts/BxRn1ySMu.png og:image:alt: Vercel breach traced to OAuth chain, MCP STDIO flaw hits 200K servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vercel breach traced to OAuth chain, MCP STDIO flaw hits 200K servers **[Backend Digest](https://daily.dev/sources/backend_digest)** · 6 min read · 0 upvotes · 0 comments ## Summary A compromised Context.ai employee device triggered an OAuth credential chain that reached Vercel's internal systems, exposing environment variables and potentially npm/GitHub tokens; ShinyHunters is demanding $2M. A structural flaw in MCP's STDIO transport allows arbitrary OS command execution on roughly 200,000 exposed servers across tools like LangFlow, LiteLLM, and Windsurf — Anthropic declined to patch at the protocol level, leaving responsibility to individual developers. Claude Desktop for macOS silently installs a Native Messaging bridge pre-authorizing browser extensions without user consent, with access to DOM state, form fields, and screen capture. Cloudflare shipped Project Think, introducing Fibers — durable agent primitives that checkpoint execution state using SQLite rather than replay, enabling agents to resume exactly where they paused. Also covered: Kimi K2.6 open release, Claude Opus 4.7 GA, a $290M KelpDAO theft by Lazarus Group, Ubuntu 26.04 cgroup v1 cutover, critical Thymeleaf SSTI and Cisco Webex SSO CVEs, GitHub Copilot training opt-out changes, and an Axios supply chain attack. ## Content **TLDR:** A compromised Context.ai employee device kicked off a credential chain that reached Vercel's internal systems, exposing non-sensitive environment variables and potentially GitHub and npm tokens. Separately, a structural flaw in MCP's STDIO transport is sitting open on roughly 200,000 servers, and Anthropic has declined to patch it at the protocol level. Claude Desktop is also drawing scrutiny for silently installing a Native Messaging bridge that pre-authorizes browser extensions without user consent. On the infrastructure side, Cloudflare shipped Project Think — a concrete set of durable agent primitives worth understanding if you're building anything that needs to survive a restart. --- ## Vercel breach via OAuth chain from Context.ai A Lumma Stealer infection on a Context.ai employee's personal device — picked up from a game exploit download — led to stolen OAuth tokens, which attackers used to impersonate the Context.ai app and pivot into a Vercel employee's Google Workspace account. From there they reached Vercel's internal systems and accessed environment variables not marked as sensitive. The ShinyHunters group is claiming responsibility and demanding $2 million, with unconfirmed reports of stolen npm and GitHub tokens that could enable downstream supply chain attacks on packages like Next.js. Vercel confirmed sensitive-flagged variables stayed protected and no supply chain tampering has been confirmed. If you're a Vercel customer, rotate non-sensitive env var secrets now, audit OAuth grants in Google Workspace, and mark everything sensitive going forward. ## MCP STDIO transport enables RCE, Anthropic calls it expected behavior OX Security found that MCP's STDIO transport lets client applications pass arbitrary commands to MCP servers as subprocesses with no built-in filtering — meaning an attacker can execute arbitrary OS commands on the host. They documented four vulnerability classes across real production services including LangFlow, LiteLLM, and Windsurf, issued 10 CVEs rated high or critical, and mapped roughly 200,000 exposed servers. Anthropic reviewed the disclosure and declined to patch the protocol architecture, saying the behavior is expected and client developers should implement their own command filtering. The problem is that few actually do — nobody's blocking `bash`, `curl`, or `powershell` by default. A single allowlist in Anthropic's own SDKs would raise the floor for packages with 150 million combined downloads. Instead, the responsibility is distributed across hundreds of individual developers. ## Claude Desktop silently installs browser bridge Privacy consultant Alexander Hanff found that Claude Desktop for macOS writes a Native Messaging manifest to seven Chromium-based browsers on install — including browsers not yet installed on the machine — without disclosure or consent. The manifest pre-authorizes three Chrome extension IDs to spawn a helper binary that runs outside the browser sandbox at user privilege level, with access to authenticated sessions, DOM state, form fields, and screen capture. The file is rewritten on every Claude Desktop launch. Security consultant Noah Kenney confirmed the technical claims are reproducible and agrees it breaks standard trust boundaries, though he disputes the spyware label since no active data exfiltration has been demonstrated. Anthropic hasn't responded publicly. ## Cloudflare Project Think: durable agent primitives Cloudflare shipped an experimental extension of its Agents SDK that rethinks how agents handle state and execution. The centerpiece is Fibers — a primitive for long-running durable invocations that checkpoint their own instruction pointer using `ctx.stash()` alongside a co-located SQLite database. Unlike replay-based systems (Google ADK, AWS Bedrock AgentCore), Fibers pick up exactly where execution paused rather than re-running from a snapshot, which matters because replay can re-execute side effects if you're not careful. Built on top: sub-agents with isolated SQLite storage and typed RPC, sessions stored as relational trees with `parent_id` branching for parallel reasoning paths, and Dynamic Workers — restricted V8 isolates where agents can write and execute their own extensions at runtime. The Fibers checkpointing approach is the most technically interesting part; the rest is useful scaffolding that follows naturally from having reliable execution state. --- ## Also notable - **Kimi K2.6 open release:** Moonshot AI released a 1T parameter MoE model (32B activated) under a Modified MIT License, hitting 80.2% on SWE-Bench Verified and supporting agent swarm orchestration up to 300 sub-agents; deployable via vLLM or SGLang. - **Claude Opus 4.7 on Bedrock and Vertex AI:** Now generally available with a 1M token context window, 64.3% SWE-bench Pro score, adaptive thinking, and high-resolution image support. - **KelpDAO $290M theft:** Lazarus Group (TraderTraitor) compromised DVN nodes validating cross-chain messages, DDoS'd healthy nodes to force fallback to poisoned ones, then authorized movement of ~116,500 rsETH; Aave froze rsETH as collateral. - **Ubuntu 26.04 cgroup v1 cutover:** Releasing April 23rd, it will block upgrades if the host is still using cgroup v1 for containers — no wind-down period, unlike Red Hat's gradual phase-out; Docker older than 20.10 is affected. - **Thymeleaf SSTI patch:** CVE-2026-40478 (CVSS 9.1) allows sandbox bypass and RCE via a tab character after `new` and Spring classes not covered by the blocklist; all versions before 3.1.4.RELEASE are affected, upgrade immediately. - **Cisco Webex SSO flaw:** CVE-2026-20184 (CVSS 9.8) allows unauthenticated user impersonation via SAML; Cisco patched their side but admins must manually upload a new IdP SAML certificate to Webex Control Hub or the vulnerability stays open. - **Windows Server emergency patch:** Microsoft issued an out-of-band fix for LSASS crashes on domain controllers caused by the April Patch Tuesday update, which triggered restart loops in multi-domain forests using PAM. - **GitHub Copilot training opt-out:** Starting April 24th, interaction data from Copilot Free, Pro, and Pro+ users will be used for model training by default unless users opt out. - **Axios supply chain attack:** Malicious versions (1.14.1 and 0.30.4) were live for roughly 3 hours on March 31st via a hijacked maintainer account, bundling a cross-platform RAT; revert to 1.14.0 or 0.30.3 and rotate credentials. - **Amazon DocumentDB in-place upgrade:** Now supports major version upgrades from 5.0 to 8.0 with no new cluster, endpoint changes, or index rebuilds; version 8.0 brings up to 7x lower query latency and 30x faster vector index builds. - **Amazon EKS IAM condition keys:** Seven new keys for cluster creation APIs let organizations enforce private-only endpoints, customer-managed KMS keys, approved Kubernetes versions, and deletion protection via SCPs. - **Encore Rust runtime results:** 67,000-line Rust runtime replacing a Go sidecar yields 9x Express.js throughput and 80% lower P99 latency, with Node.js handling only business logic. - **Quantum timeline compression:** Google and Oratomic research suggests breaking P-256 may require as few as 10,000–26,000 qubits, dramatically lower than prior estimates; Google revised its Q-Day estimate to 2029. - **Scattered Spider guilty plea:** Tyler Buchanan, 24, pleaded guilty to wire fraud and aggravated identity theft for a phishing and SIM-swap scheme that stole at least $8 million in crypto from over a dozen companies; sentencing August 2026. ## Similar posts on daily.dev - [From MCP to Shell](https://daily.dev/posts/from-mcp-to-shell-ujllhoeux) · Hacker News · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloudflare](https://daily.dev/tags/cloudflare), [#mcp](https://daily.dev/tags/mcp), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/vercel-breach-traced-to-oauth-chain-mcp-stdio-flaw-hits-200k-servers-bxrn1ysmu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/vercel-breach-traced-to-oauth-chain-mcp-stdio-flaw-hits-200k-servers-bxrn1ysmu","headline":"Vercel breach traced to OAuth chain, MCP STDIO flaw hits 200K servers","text":"A compromised Context.ai employee device triggered an OAuth credential chain that reached Vercel's internal systems, exposing environment variables and potentially npm/GitHub tokens; ShinyHunters is demanding $2M. A structural flaw in MCP's STDIO transport allows arbitrary OS command execution on roughly 200,000 exposed servers across tools like LangFlow, LiteLLM, and Windsurf — Anthropic declined to patch at the protocol level, leaving responsibility to individual developers. Claude Desktop for macOS silently installs a Native Messaging bridge pre-authorizing browser extensions without user consent, with access to DOM state, form fields, and screen capture. Cloudflare shipped Project Think, introducing Fibers — durable agent primitives that checkpoint execution state using SQLite rather than replay, enabling agents to resume exactly where they paused. Also covered: Kimi K2.6 open release, Claude Opus 4.7 GA, a $290M KelpDAO theft by Lazarus Group, Ubuntu 26.04 cgroup v1 cutover, critical Thymeleaf SSTI and Cisco Webex SSO CVEs, GitHub Copilot training opt-out changes, and an Axios supply chain attack.","url":"https://daily.dev/posts/vercel-breach-traced-to-oauth-chain-mcp-stdio-flaw-hits-200k-servers-bxrn1ysmu","datePublished":"2026-04-21T04:18:02.272Z","dateModified":"2026-04-21T04:18:22.398Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Vercel breach traced to OAuth chain, MCP STDIO flaw hits 200K servers"}]} ```