Shadow AI's Other Half: The Access Employees Grant, Not Just What They Type

This post is informational and reflects the incident as disclosed as of May 2026. For your own environment, consult a licensed attorney or security professional.

Most shadow-AI policies worry about what employees type into AI tools. A 2026 incident at Vercel points at the other half of the problem, the one most policies miss: the access employees grant when they connect an AI tool to a corporate account.

Here is what Vercel disclosed. An employee connected a third-party AI tool, Context.ai, to his Vercel Enterprise Google Workspace account, granting broad OAuth permissions in the process. Earlier, in February 2026, Context.ai had itself been compromised (by the Lumma Stealer malware). The attackers used the Google Workspace OAuth tokens from that compromise to take over the employee’s account, pivot into Vercel’s systems, and access customer data over the following weeks. A threat actor later reportedly claimed to be selling the stolen data for around $2 million. Vercel said certain sensitive environment variables were encrypted and not accessed; variables not marked sensitive should be treated as exposed.

The lesson: an OAuth grant is a standing key

The intrusion did not start with a phishing email or a stolen password at Vercel. It started with a legitimate employee clicking “accept” on a permissions screen for an AI tool, granting it read access to a corporate Workspace. When that tool was later breached, the access came with it. An OAuth grant is not a one-time login; it is a durable key you hand to a third party, and it is only as safe as that third party.

That reframes the shadow-AI question. It is not only what are employees putting into AI tools. It is what access have employees given AI tools, and to which corporate systems.

What to do

Inventory the grants. In Google Workspace, an administrator can list the third-party apps employees have authorized (Admin Console → Security → Access and data control → API controls → Manage App Access). Most organizations are surprised by what turns up.
Gate the broad scopes. Require admin approval before any tool receives Gmail, Drive, Admin SDK, or other broad Workspace permissions. “Read all Drive” for a convenience tool is the grant to stop.
Treat connected tools as vendors. A tool with standing access to your data is part of your attack surface whether or not procurement ever reviewed it. Its breach can become your breach.

The takeaway is not “ban AI tools.” It is that connecting one is a data-access decision, not a personal-productivity one, and it deserves the same scrutiny as any other vendor with a key to your systems. (For the policy side, see Shadow AI in the Workplace, and the firm’s Privacy & Data Security practice.)

If employees are connecting AI tools to your corporate accounts and no one is reviewing the permissions, talk to MB Legal.

This post is informational and does not constitute legal advice. It describes an incident as publicly disclosed; see Vercel’s security bulletin for the company’s account. For guidance on your situation, consult a licensed attorney.