AI NewsAnother customer of troubled startup Delve suffered a big security incident

Another customer of troubled startup Delve suffered a big security incident

10:10 PM IST · April 23, 2026

The story of embattled compliance startup Delve keeps hitting twists and turns. TechCrunch has confirmed that Delve was the compliance company that performed the security certifications for Context AI, the AI agent training startup that last week disclosed a security incident whichled to a data breach at popular app and website hosting giant Vercel. On the other hand, Lovable, which had its own security incident, is no longer a Delve customer. To recap: Last month, Delve came under fire when an anonymous whistleblower alleged thatthe startup was faking customer dataand using rubber-stamping auditors in its compliance and certifications processes. Delve has denied those allegations. Soon afterwards, hackers attackedone of Delve’s security certification customers, LiteLLM, and planted malware in its open source code. After the incident, LiteLLM told TechCrunch it was dumping Delve and getting re-certified. Delve was alsoaccused of taking an open source tooland passing it off as its own work without proper license attribution. The startup’s reputation grew shaky, promptingY Combinator, where Delve graduated from, to sever ties. Fast-forward to last weekend, Vercel said hackers hadbreached its internal systems and accessed some customer data. The company said hackers broke in after an employee downloaded an app made by Context AI and connected that app to Vercel’s corporate account hosted by Google. The hackers abused that employee’s access to their Google account to break into some of Vercel’s internal systems. After Context AI was named in the Vercel attack, Gergely Orosz, author of the engineering newsletter The Pragmatic Engineer, saidin a post on Xthat Delve was the company that handled Context AI’s security certification. Context AI has now confirmed to TechCrunch that it did use Delve, but it has since ditched the startup and is in the process of getting re-certified. “Yes, Context was previously a Delve customer,” a spokesperson for Context AI told TechCrunch. “Following the reporting surrounding Delve in March, we transitioned our compliance program to Vanta and engaged Insight Assurance, an independent audit firm, to conduct new examinations. As part of the re-examination, we began updating our public materials, and we’ll share the new attestation when it is complete,” the spokesperson added. Security certifications on their own don’t stop security issues. They are intended to verify that a company has policies and processes in place to hinder attacks and reduce the likelihood of customer data being compromised. Case in point: Lovable was a Delve customer, butafter the whistleblower’s allegations came out,the vibe-coding platform said it had ditched the startup back in late 2025. The company has already re-completed one security certification, and is in process of redoing others, it said. Still, Lovable onMonday admittedthat it had inadvertently shared access to customer chat data publicly. The company also said it had dismissed vulnerability reports that alerted the company to the problem months earlier. Lovable apologized for initially denying there was a data breach, though it said the issue was caused by a configuration error, rather than a hack. There’s even weirder news swirling around Delve. The anonymous whistleblower, DeepDelver, haspublished another postalleging Delve was denying refunds to customers, but still took its team of more than 20 people to an offsite meeting in Hawaii between April 15 and April 19. The whistleblower shared some compelling receipts with TechCrunch that lend credence to the alleged Hawaii trip, but TechCrunch could not confirm other claims. After publication, Delve declined comment.