The Department of Know: Vercel breach, a "Contagious Interview," and ghost breaches

This episode of Cybersecurity Headlines dives into several high-impact security incidents, starting with insurers introducing sublimits on AI-related cyber claims—a move seen as both a market correction and a signal of the nascent state of AI risk modeling. The discussion then shifts to a reported unauthorized access to Anthropic's Mythos model via a Discord group exploiting a third-party contractor’s credentials, highlighting the dangers of supply chain risk and identity sprawl. The long-term impact of a 2024 ransomware attack on London hospitals underscores the critical gap between 'recovered' and 'restored' systems, with lasting operational and patient safety consequences. A separate story reveals the FBI used a flaw in iOS’s notification system to access deleted messages, reinforcing the principle that strong encryption can be undermined by endpoint artifacts. The centerpiece is the Vercel breach, triggered by an employee installing a browser extension and granting 'allow all' OAuth access to a compromised third-party tool, Context.ai—exposing customer environment variables. The hosts emphasize that OAuth token sprawl is now a primary attack vector, urging organizations to prioritize visibility and governance over default 'allow all' permissions. The episode closes with a strong call to action: invest in resilience, not just prevention, and treat identity and access control as foundational to modern security strategy.