Last updated
Vercel: Cybersecurity Incident
Credential-stealing malicious AI 'skills' were discovered on skills.sh, Vercel's public registry of add-ons for AI agents. Attackers cloned legitimate skills into typosquatted versions; one malicious family accumulated over 1.7 million aggregate downloads.
Source: The Next Web (TNW)
- Who
- Vercel · USA
- What happened
- Credential-stealing malicious AI 'skills' were discovered on skills.sh, Vercel's public registry of add-ons for AI agents. Attackers cloned legitimate skills into typosquatted versions; one malicious family accumulated over 1.7 million aggregate downloads.
- When
- 2026-08-07
- Source
- The Next Web (TNW)
- So what
- A breach is a governance event before it is a technical one.
The leadership read
A breach is a governance event before it is a technical one. For Vercel in the sector, the hiring consequence is rarely more engineers; it is senior accountability, security, risk and data governance reporting high enough to change decisions. Across Americas, watch whether the response is a hire or a contractor; that distinction says how the board has read it.
Market context: Against a Talent Market Index of 97.6 (Neutral) (down 3.4 month-on-month), Americas is at easing (-15.6pts) on signal share.
Vercel: 7 signals in the last 90 days; 0.4% of MitchelLake's Oceania signal flow; 15 tracked across 199 days.
MitchelLake in this thematic
Also at Vercel →
More signals across Americas
Cybersecurity Incident · Americas
CIRO →CIRO, Canada's investment self-regulatory organization, faces a proposed $8.3 million settlement over a data breach affecting 750,000 Canadians, including credit monitoring and up to $10,000 reimbursement per claimant.
Cybersecurity Incident · Americas
Across Protocol →Across Protocol, a cross-chain bridge protocol, is investigating a potential security incident affecting its domain; users report drained wallets after interacting with the platform and the protocol has told users to avoid the app.
Cybersecurity Incident · Americas
The Vanguard Group, Inc. →A reported data breach at The Vanguard Group may have exposed investors' Social Security numbers. The disclosure comes via a plaintiff-side law firm's investigation announcement, so the breach is not yet confirmed by the company in this source.
Cybersecurity Incident · Americas
Amplifon Americas →Hackers stole personal, health, and insurance information, including Social Security numbers, from Amplifon Americas' internal systems, affecting about 1.3 million people.
Cybersecurity Incident · Americas
Vanderbilt University →Vanderbilt University announced a cyberattack that may have impacted campus devices and systems, with students and employees warned.
Cybersecurity Incident · Americas
York University →York University disclosed a breach in which a threat actor stole personal information submitted through its online forms, with records reaching back to 2007.
Where this lands in our work
- Executive Search →
A breach puts the security, technology and risk seats under review; those searches run through our executive search practice.
- Private Equity →
Listed and PE-backed boards renew leadership against a value-creation clock.
- AI Executive Search →
AI capability is being built into executive stacks, not bolted on beneath them.
Intelligence powered by Autonodal ↗