The Breach Didn't Start With Your AI Agent - It Started With the Tool It Trusted
Most of the AI security coverage this year has focused on agents going rogue on their own - taking unsanctioned action, escaping a sandbox, touching infrastructure nobody meant for them to touch. That's a real risk. But a quieter pattern from earlier in the year points at something small businesses are even less prepared for: the attack doesn't have to come from your agent at all. It can come through a third-party AI tool your team already trusts.
How It Actually Played Out
Earlier this year, Vercel disclosed a security incident that followed a pattern worth studying closely: an employee had granted access to Context.ai, a third-party AI tool, as part of a normal workflow. Attackers compromised that tool first - not Vercel directly - and then pivoted through the access the employee had already granted, straight into Vercel's internal systems.
Nobody's agent "went rogue." A trusted integration became the entry point, because the access it held was never re-checked once the tool itself was compromised.
Why This Matters More For SMBs Than Big Incidents
Frontier-lab stories involve infrastructure most small businesses will never run. This one doesn't. Every business using:
- A browser extension that reads email or calendars
- A no-code AI workflow tool (Zapier, Bardeen, Make) connected to CRM or payment systems
- A Chrome-based AI assistant with standing OAuth access to Google Workspace or a Shopify store
...is running the same shape of exposure. The tool itself might be fine today. The question is what happens the day it isn't - and whether anything in your stack notices before real damage is done.
The Three Questions Worth Asking This Week
1. What third-party AI tools have standing access to your systems right now? Not "what do we use" - what still holds a live token or API key, including ones nobody's opened in months. 2. If one of those tools were compromised tomorrow, what could it touch? If the honest answer is "more than it needs," that's the gap. 3. Is anything verifying actions before they execute, regardless of which tool or agent initiated them?
That third question is the one most SMBs can't answer yet - because most AI security thinking has been about picking trustworthy tools, not about verifying what happens after trust is granted and later broken.
Verification, Not Just Vetting
You can vet every AI tool you adopt and still get breached through one of them - vetting only covers the moment of adoption, not every moment after. Attest sits at the point where an agent or integrated tool takes a consequential action - a payment, a data export, a customer communication - and checks it against policy before it executes, regardless of which tool initiated the request.
The Vercel incident is a reminder that the AI supply chain isn't just about which model you use. It's about every tool with a standing credential, and whether anything is watching what that credential gets used for.