Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

VibeScamming refers to AI-assisted phishing operations where attackers use natural-language tools to rapidly generate and modify phishing content and web pages, lowering (but not eliminating) the technical skill required. One of the primary enterprise impacts is faster phishing iteration and reconstitution after blocks or takedowns, with identity compromise remaining a major risk alongside malware and other payload-based attacks.

Public reporting suggests the incident involved abuse of a third-party application that had been granted OAuth access to a Vercel employee account, enabling unauthorized access to some internal resources. Certain customer‑related tokens, environment variables, or other access artifacts may have been exposed, though Vercel has not stated that password theft was part of the initial access path.

Generative AI–and large language models in particular–reached mass consumer adoption beginning in late 2022 and early 2023, with ChatGPT reaching 100 million users faster than any consumer application in history. Since then, AI has advanced at a breakneck pace and now seems to be incorporated in every tool, app, and website–regardless of how useful it might actually be.

The patch management process is the structured lifecycle through which organizations identify, test, and deploy software and firmware updates to close security vulnerabilities before cyberattacks can exploit them.

Attackers carried out a supply chain compromise by abusing a compromised npm maintainer account to publish malicious Axios versions (axios@1.14.1 and axios@0.30.4). These releases introduced an unexpected dependency, plain-crypto-js@4.2.1, which attempted platform-specific malware execution via an npm lifecycle script during installation on Windows, macOS, and Linux.

Source code for Claude Code, Anthropic’s developer facing CLI tool, was exposed through source maps included in a published npm package under Anthropic’s npm namespace. The exposure revealed approximately 500,000 lines of application code across roughly 1,900 files.

We brought the message of Autonomous IT to the leading security show, and people took notice.