Vercel: AI Agents Amplify Static Key Risks; Marketplace to Remove Vendors Without Secure Authentication Starting in 2027
Vercel argues that machine-to-machine authentication is at the same stage HTTPS was in 2010—standards exist but adoption is extremely low. AI agents exacerbate this by granting permissions far exceeding task requirements. Vercel surveyed over 1,000 SaaS vendors and found only 8.4% support secure authentication methods, proposing tool simplification and delisting deadlines to drive change.
Vercel posits in its official blog that machine-to-machine authentication currently resembles the state of HTTPS in 2010: standards such as OAuth and OIDC provide the foundational building blocks for secure authentication, yet long-lived static credentials (API keys, database passwords) remain the default practice for most SaaS vendors and infrastructure providers. Vercel believes that standards alone do not make secure methods the norm; the widespread adoption of HTTPS relied on tools that made encryption easy, coupled with sustained efforts to make it the expected standard.
The article identifies AI agents as a factor significantly worsening this issue. Developers now grant agents access to systems, tools, and data through credentials, often conferring permissions far beyond what is necessary for the agent's current task. Credentials may leak into code repositories or chat logs, be stolen when a service or dependency is compromised, or fall into attackers' hands if prompt injection causes an agent to actively expose them. Regardless of the vector, an attacker can use the credential until it expires or is revoked. Vercel specifically notes that recent industry incidents involving credential theft and supply chain attacks demonstrate that encryption at rest is insufficient when malicious code can read application credentials in production environments.
Vercel states it previously spent thousands of engineering hours on multiple, highly painful key rotations and wishes to avoid such experiences again. This constitutes the direct motivation for driving alternative solutions.
Regarding evidence, Vercel self-reported a survey: among more than 1,000 SaaS vendors surveyed, only 8.4% supported secure authentication methods. Vercel attributes the low adoption rate to three barriers: tooling and configuration make secure authentication more complex than using static keys directly; fetching or exchanging tokens along the request path adds latency; and vendors lack incentives to offer and prioritize secure authentication.