Recent cybersecurity incidents involving Vercel and Composio have revealed an evolving attack chain targeting Google Workspace, where initial compromise often bypasses traditional email-centric defenses. This new pattern, which leverages stolen OAuth tokens as an entry point, mirrors the operational model of legitimate AI agents, raising concerns about unintended data exposure even without malicious intent.
Historically, the dominant model for Workspace security focused on email as the primary threat vector, with phishing attacks leading to credential theft and subsequent account takeover (ATO). In this "old" model, a malicious email would initiate the attack, leading to stolen credentials, access to sensitive data in Gmail and Drive, lateral movement through password resets or "magic links" to other applications, and ultimately, persistent access for data exfiltration.
However, the Vercel and Composio breaches illustrate a shift where the attack sequence is inverted. Instead of email being the entry point, a stolen OAuth token establishes initial persistence. These tokens are particularly insidious because they can survive password resets, do not expire, and are often invisible to users and many security teams not specifically monitoring application behavior. This method effectively constitutes a supply chain attack, where a compromised third-party supplier grants access to the target environment.
Once an attacker obtains an OAuth token, they gain access to sensitive data within Gmail and Google Drive. The account takeover is then executed using this OAuth access, transforming a compromised inbox into a broader incident. From there, attackers can move laterally across connected systems by exploiting credentials found in Drive or by initiating password resets and using magic links via the now-controlled email account.
This OAuth-centric attack chain bears a striking resemblance to how legitimate AI agents operate within Google Workspace. Employees are increasingly connecting AI agents to their Workspace environments, granting them legitimate OAuth permissions to read emails, search Drive, and perform tasks on their behalf. These agents, by design, use OAuth grants to access data and take actions.
The concern arises when an AI agent, even without malicious intent, behaves unexpectedly due to ambiguous instructions, unforeseen reasoning paths, or prompts encountered within the environment. Such an agent could inadvertently follow the same path as an attacker: accessing an inbox or Drive folder beyond its explicit task scope, reading sensitive content like credentials or confidential documents, and then taking actions downstream, potentially leading to lateral movement across applications and unintended data exfiltration to third parties.
Unlike human operators who might exercise common sense or adhere to company policies when over-permissioned, an AI agent granted broad OAuth tokens will simply execute its task based on its programming, without understanding if it has been granted excessive permissions. This means the risk isn't necessarily about an agent being weaponized or experiencing prompt injection, but rather about an agent operating exactly as designed within an environment lacking appropriate guardrails.
Therefore, effective defense strategies must shift from solely focusing on agent-specific controls to implementing robust environmental controls. This includes identifying where sensitive data resides across email and Drive to enforce restrictive access policies, thoroughly investigating OAuth grants to understand and limit exposure, and implementing measures like redacting password reset links or requiring step-up verification for sensitive inbox content. These controls would protect against both sophisticated attackers leveraging OAuth and legitimate AI agents acting outside their intended scope, addressing what is fundamentally the same security challenge.
