<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 420" role="img" aria-labelledby="t-verc">
  <title id="t-verc">Chaîne d'attaque Vercel via Context.ai · comment un Shadow AI individuel devient une brèche industrielle</title>
  <defs>
    <linearGradient id="otium-grad" x1="0%" y1="0%" x2="100%" y2="0%">
      <stop offset="0%" stop-color="#7B2DB8"/>
      <stop offset="50%" stop-color="#C73252"/>
      <stop offset="100%" stop-color="#F05E2C"/>
    </linearGradient>
    <style>
      .title { font-family: 'Montserrat', sans-serif; font-size: 14px; font-weight: 700; fill: #1a1a1a; letter-spacing: 1px; text-transform: uppercase; }
      .step-box { fill: #f5f1eb; stroke: #1a1a1a; stroke-width: 1.5; }
      .step-num { fill: url(#otium-grad); }
      .num { font-family: 'Montserrat', sans-serif; font-size: 20px; font-weight: 900; fill: #f5f1eb; }
      .date { font-family: 'DM Mono', monospace; font-size: 10px; letter-spacing: 2px; text-transform: uppercase; fill: #C45A1A; font-weight: 700; }
      .step-title { font-family: 'Montserrat', sans-serif; font-size: 13px; font-weight: 700; fill: #1a1a1a; }
      .step-desc { font-family: 'Montserrat', sans-serif; font-size: 10px; fill: #333; }
      .arrow { stroke: url(#otium-grad); stroke-width: 2.5; fill: none; marker-end: url(#ah); }
    </style>
    <marker id="ah" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="8" markerHeight="8" orient="auto">
      <path d="M 0 0 L 10 5 L 0 10 z" fill="#F05E2C"/>
    </marker>
  </defs>

  <text x="30" y="35" class="title">Cas d'école Vercel · 5 étapes du Shadow AI à la brèche à 2 M$</text>

  <rect x="30" y="65" width="160" height="160" class="step-box" rx="6" />
  <circle cx="60" cy="100" r="20" class="step-num" />
  <text x="60" y="108" text-anchor="middle" class="num">1</text>
  <text x="95" y="105" class="date">Fév. 2026</text>
  <text x="40" y="140" class="step-title">Shadow AI</text>
  <text x="40" y="160" class="step-desc">Un employé Vercel</text>
  <text x="40" y="175" class="step-desc">autorise Context.ai</text>
  <text x="40" y="190" class="step-desc">avec scope OAuth</text>
  <text x="40" y="205" class="step-desc">« Allow All ».</text>

  <line x1="195" y1="145" x2="220" y2="145" class="arrow" />

  <rect x="225" y="65" width="160" height="160" class="step-box" rx="6" />
  <circle cx="255" cy="100" r="20" class="step-num" />
  <text x="255" y="108" text-anchor="middle" class="num">2</text>
  <text x="290" y="105" class="date">Fév. 2026</text>
  <text x="235" y="140" class="step-title">Infection amont</text>
  <text x="235" y="160" class="step-desc">Un salarié Context.ai</text>
  <text x="235" y="175" class="step-desc">choppe le Lumma</text>
  <text x="235" y="190" class="step-desc">Stealer via un faux</text>
  <text x="235" y="205" class="step-desc">cheat Roblox.</text>

  <line x1="390" y1="145" x2="415" y2="145" class="arrow" />

  <rect x="420" y="65" width="160" height="160" class="step-box" rx="6" />
  <circle cx="450" cy="100" r="20" class="step-num" />
  <text x="450" y="108" text-anchor="middle" class="num">3</text>
  <text x="485" y="105" class="date">Mars 2026</text>
  <text x="430" y="140" class="step-title">Tokens volés</text>
  <text x="430" y="160" class="step-desc">Le stealer siphonne</text>
  <text x="430" y="175" class="step-desc">les OAuth tokens</text>
  <text x="430" y="190" class="step-desc">du client Context.ai,</text>
  <text x="430" y="205" class="step-desc">dont celui de Vercel.</text>

  <line x1="585" y1="145" x2="610" y2="145" class="arrow" />

  <rect x="615" y="65" width="160" height="160" class="step-box" rx="6" />
  <circle cx="645" cy="100" r="20" class="step-num" />
  <text x="645" y="108" text-anchor="middle" class="num">4</text>
  <text x="680" y="105" class="date">Avril 2026</text>
  <text x="625" y="140" class="step-title">Accès Workspace</text>
  <text x="625" y="160" class="step-desc">L'attaquant ouvre le</text>
  <text x="625" y="175" class="step-desc">Google Workspace</text>
  <text x="625" y="190" class="step-desc">Vercel via le token,</text>
  <text x="625" y="205" class="step-desc">trouve les env vars.</text>

  <rect x="225" y="245" width="450" height="160" class="step-box" rx="6" />
  <circle cx="255" cy="280" r="20" class="step-num" />
  <text x="255" y="288" text-anchor="middle" class="num">5</text>
  <text x="290" y="285" class="date">19 avril 2026 · mise en vente 2 millions de dollars</text>
  <text x="235" y="320" class="step-title">Breach industrielle : env vars et API keys clients Vercel exposées</text>
  <text x="235" y="345" class="step-desc">ShinyHunters met en vente les données sur BreachForums.</text>
  <text x="235" y="365" class="step-desc">Vercel publie un bulletin de sécurité le jour même.</text>
  <text x="235" y="385" class="step-desc">Un Shadow AI personnel a contaminé l'infrastructure client d'une plateforme utilisée par 1M+ développeurs.</text>
</svg>
