"We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI."
the ai bubble is so funny to me, vercel gets compromised and the ceo praises the hackers for their sophisticated use of AI.
Here's my update to the broader community about the ongoing incident investigation. I want to give you the rundown of the situation directly.
A Vercel employee got compromised via the breach of an AI platform customer called Context.ai that he was using. The details are being fully investigated.
Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments.
Vercel stores all customer environment variables fully encrypted at rest. We have numerous defense-in-depth mechanisms to protect core systems and customer data. We do have a capability however to designate environment variables as “non-sensitive”. Unfortunately, the attacker got further access through their enumeration.
We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.
At the moment, we believe the number of customers with security impact to be quite limited. We’ve reached out with utmost priority to the ones we have concerns about. All of our focus right now is on investigation, communication to customers, enhancement of security measures, and sanitization of our environments. We’ve deployed extensive protection measures and monitoring. We’ve analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community.
The recommendation for all Vercel customers is to follow the Security Bulletin closely (vercel.com/kb/bulletin/verce…). My advice to everyone is to follow the best practices of security response: secret rotation, monitoring access to your Vercel environments and linked services, and ensuring the proper use of the sensitive env variables feature.
In response to this, and to aid in the improvement of all of our customers’ security postures, we’ve already rolled out new capabilities in the dashboard, including an overview page of environment variables, and a better user interface for sensitive env var creation and management. As always, I’m totally open to your feedback.
We’re working with elite cybersecurity firms, industry peers, and law enforcement. We’ve reached out to Context to assist in understanding the full scale of the incident, in an effort to protect other organizations and the broader internet. I also want to thank the Google Mandiant team for their active engagement and assistance.
It’s my mission to turn this attack into the most formidable security response imaginable. It’s always been a top priority for me. Vercel employs some of the most dedicated security researchers and security-minded engineers in the world. I commit to keeping you updated and rolling out extensive improvements and defenses so you, our customers and community, can have the peace of mind that Vercel always has your back.
Troy retweeted
its really heartbreaking to see people spread the same lies about me especially since i've debunked all of this over 2 years ago.
Troy retweeted
Here’s what I’d do if I was in charge of GitHub, in order:
1. Have more than one 9 of uptime
2. Have more than two 9s of uptime
3. Have more than three 9s of uptime (this one’s hard)
4. Have more than four 9s of uptime
5. Have more than five 9s of uptime
Here’s what I’d do if I was in charge of GitHub, in order:
1. Establish a North Star plan around being critical infrastructure for agentic code lifecycles and determine a set of ways to measure that.
2. Fire everyone who works on or advocates for copilot and shut it down. It’s not about the people, Im sure theres many talented people, youre just working at the wrong company.
3. Buy Pierre and launch agentic repo hosting as the first agentic product. Repos would be separate from the legacy web product to start since they’re likely burdened with legacy cross product interactions.
4. Re-evaluate all product lines and initiatives against the new North Star. I suspect 50% get cut (to make room for different ones).
The big idea is all agentic interactions should critically rely on GitHub APIs. Code review should be agentic but the labs should be building that into GH (not bolted in through GHA like today, real first class platform primitives). GH should absolutely launch an agent chat primitive, agent mailboxes are obviously good. Etc. GH should be a platform and not an agent itself.
This is going to be very obviously lacking since I only have external ideas to work off of and have no idea how GitHub internals are working, what their KPIs are or what North Star they define, etc.
But, with imperfect information, this is what I’d do.
I decided to check back on this after some time. coin went to zero. its almost if it was a scam and everyone just hated on me for calling it what it was because the guy was dying.
I have never seen a bigger scam than this. This is fucking crazy. Who the fuck does a raising money for cancer by my memecoin $CANCER what the actual fuck is wrong with these people. PUMP DOT FUN??? Every day we stray further from god
Surely this won’t be binding
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
I have never seen a bigger scam than this. This is fucking crazy. Who the fuck does a raising money for cancer by my memecoin $CANCER what the actual fuck is wrong with these people. PUMP DOT FUN??? Every day we stray further from god
For anybody wondering what is going on with $CANCER live stream... my life was saved for whole 24 hours untill someone tuned in my stream and got me to download verified game on @Steam
After this I was drained for over 32,000$ USD of my creator fees earned on @pumpdotfun and everything quickly changed.
I can't breathe, I can't think, im completely lost on what is going to happen next, can't shake the feeling that it is my fault that I might end up on street again or not have anything to eat in few days... my heart wants to jump out of my mouth and it hurts.
I won't rewatch this myself but I have added a clip from the stream after I noticed what has happened.
also I have succesfully (CTOed) my creator rewards and they have been redirected to safe device.
@a1lon9
It’s funny cause it would require him to pump Tesla stock to like 8 trillion or smth crazy so he’s just never gonna get it and it’s all just for headlines cause he’s a child
ever wanted to advertise my company for free? well now you can!
We shipped a new "Built with Cloudflare" button! You can embed this on your website or application to show off your favorite tech stack :)
developers.cloudflare.com/wo…



























