Cursor breach leaked creds via stolen LLM transcripts; Vercel says kill static keys
jobergum · x · 2026-11-15
Cursor's post-mortem confirms static credentials leaked through stolen LLM transcripts containing them. Vercel CTO Malte Ubl argues the only real fix is eliminating long-lived static credentials, drawing a parallel to the HTTPS-everywhere push: OAuth/OIDC/DBSC standards exist but machine-to-machine auth still resembles 2010. Vercel is shipping an OIDC UI registry, expanding OIDC support, and setting new auth requirements for Marketplace providers. Lesson for the agent era: secrets increasingly live in transcripts and logs.
More from coding & agent
- Vibecoding beats general-purpose software: dev builds his own timelapse video editor — mishig25 · 2026-11-15
- After 2 Years of Building AI Agents, He Landed on Go + Temporal — littlebobbyt · 2026-11-15
- E2B sandbox pattern in Alchemy: build a template snapshot at deploy, fork at runtime — samgoodwin89 · 2026-11-15
- AI Frog With Vector Memory: Forgetting, Recalling, Fed by Everyone — Vast-Grapefruits · 2026-11-15
- Alchemy adds Rivet, Effect Cluster and 8 sandbox platforms with swap-one-layer portability — samgoodwin89 · 2026-11-15
- Open-source NHL MCP server serves live game stats via natural language queries — modelcontextprotocol · 2026-11-15