Two weeks after the Context.ai compromise, Vercel ships the 'Hardened Workspace' update with encrypted environment variables at rest and Agent Scopes—a new permission system that restricts AI agent access to specific files and network endpoints. The update converts the security architecture announced in the week-14 breach disclosure into concrete platform defaults, closing the primary attack surface exploited in the April incident. Agent Scopes represent the most significant change: agents now operate under least-privilege by default.