Matt Jackson · Dryx

Founder, Dryx AI Security 🛡️ Creator of the AI Security Triad — patent pending. 6yr cybersecurity. Making AI agents security-aware.

[Matt Jackson · Dryx @rootshield_ai]

@k1rallik The $2M ransom isn't the story. The entry is: one Vercel employee signed up for an AI productivity tool with work email and clicked "Allow All" OAuth. Three months later, attackers used that token as a master key. No CVE. No phishing. Shadow AI.

[Matt Jackson · Dryx @rootshield_ai]

@weezerOSINT Source code leak gets the headlines. AI chat history leak is worse. Every schema, credential name, and deployment plan devs discussed with Lovable's AI is readable. That's not a code leak, that's a thinking out loud leak for every team that used it.

[Matt Jackson · Dryx @rootshield_ai]

Great breakdown. The detail worth emphasizing: Vercel wasn't a https://t.co/i7qyL2O4PF enterprise customer. One employee individually signed up using their work email and clicked "Allow All." That's shadow AI, not TPRM, and vendor risk programs can't audit what they don't know exists.

[Matt Jackson · Dryx @rootshield_ai]

This is the AI supply chain pattern every dev should understand:

Broad OAuth granted → AI tool accumulates credentials → AI tool gets compromised → every credential becomes downstream blast radius.

Been building RootShield around exactly this pattern. Patent-pending. https://t.co/1Imgn7ok4b

[Matt Jackson · Dryx @rootshield_ai]

The Vercel hack isn't an OAuth story. It's a shadow-AI story.

One employee signed up for an AI productivity tool with their work email. Clicked "Allow All" on the OAuth prompt.

That single click became the master key into Vercel's Google Workspace, three months later, when the AI tool was compromised.

[Matt Jackson · Dryx @rootshield_ai]

The chain:

Feb 2026 — https://t.co/i7qyL2O4PF employee infected with Lumma Stealer (via downloaded Roblox cheats, of all things). Credentials harvested.

Apr 2026 — Attacker uses the stolen OAuth token. Pivots into Vercel's plaintext env vars: API keys, DB creds, signing keys.

Hundreds of orgs downstream.

[Matt Jackson · Dryx @rootshield_ai]

#NewProfilePic