Pattern: AI Tool Supply Chain Attacks Escalating — OAuth Grants Are the Primary Vector

paddo.dev·high signal

The Vercel/Context.ai breach, the Trivy/litellm credential theft, and the Axios maintainer hijack form a clear pattern: AI tool integrations are becoming the primary supply chain attack surface. The common vector is OAuth scope creep — AI tools request broad permissions, and when the vendor is compromised, attackers inherit that trust. Shadow AI (untracked tool installations without procurement review) amplifies the risk. Organizations need OAuth grant inventories and immediate revocation protocols.