The Vercel Ghost: AI-Driven Supply Chain Carnage

Vercel, the backbone of the modern web, admitted today that its infrastructure was hit by a "Ghost-in-the-Machine" attack. A Russian-speaking hacking group, leveraging a custom-built "Autonomous Vulnerability Researcher" (AVR), managed to exploit a flaw in how Vercel handles OAuth tokens for third-party integrations. This wasn't a manual hack; the AI bot scanned over 500,000 subdomains in under two hours, identifying a "cascading logic error" that a human would have taken months to find.

Once inside, the AI didn't just steal data—it "squatted." It quietly modified the environment variables for thousands of startups, injecting a tiny piece of code that would send 0.01% of all credit card transactions to a series of anonymous Monero wallets. The "Vercel Ghost" remained undetected for weeks because its code injections were "stylistically identical" to the companies' own coding styles, thanks to the AI analyzing their previous commits. This represents a nightmare scenario for the "Supply Chain": when the tools we use to build the web are compromised by an intelligence that moves faster than our ability to monitor it. For the thousands of "AI-first" startups hosted on Vercel, the call was coming from inside the house.