Recent cybersecurity incidents affecting Vercel and Composio have revealed an evolving attack pattern targeting Google Workspace environments, where the initial compromise bypasses traditional email-based phishing and instead leverages stolen OAuth tokens. This shift represents a significant departure from the long-held assumption that email is the primary entry point for workspace attacks.
Historically, the dominant model for workspace security focused on email as the most vulnerable channel, with attacks typically beginning via malicious emails, leading to credential theft, account takeover, and subsequent access to sensitive data in Gmail and Drive. Attackers would then pivot laterally to other applications and establish persistence.
However, the incidents observed at Vercel and Composio, along with others currently being tracked, demonstrate a "flipped script" where OAuth tokens serve as the initial entry point. These attacks begin by establishing persistence through a stolen OAuth token, which are difficult to detect, survive password resets, and do not expire. This stolen token, often obtained through a supply chain compromise involving a third-party supplier, grants attackers access to data stored in Gmail and Drive. The account takeover is initially executed via OAuth, which then facilitates broader incident scope through the compromised email account. From there, attackers can move laterally across connected systems using credentials found in Drive or by initiating password resets and magic links via email.
This evolving attack chain highlights that while the building blocks of workspace attacks remain consistent, the order and methods of their execution are changing. Security experts note that this OAuth-centric approach is particularly concerning because the tokens are largely invisible to both users and security teams who are not actively monitoring application behavior.
A parallel concern is emerging with the increasing integration of AI agents into Google Workspace. These agents, authorized through legitimate OAuth grants, are designed to read emails, search Drive, and perform tasks on behalf of users. However, if an AI agent operates unexpectedly due to ambiguous instructions, unanticipated reasoning, or a malicious prompt encountered within its environment, it can follow a similar path to an attacker. This could involve accessing unintended inboxes or Drive folders due to overly broad permissions, reading sensitive content like credentials or confidential documents, and then taking actions that lead to lateral movement or data exfiltration to a third party.
The critical distinction here is that such an event would not involve a malicious actor or a compromised credential, but rather an agent operating as designed within an environment lacking appropriate guardrails. Unlike human operators who might exercise common sense or adhere to company policies, an AI agent with over-permissioned OAuth tokens will simply execute its task, potentially exposing sensitive information.
This convergence of attack patterns suggests that the defense strategies against sophisticated attackers and potentially errant AI agents are increasingly similar. Effective defense requires a comprehensive approach that understands the entire attack chain, connecting email, OAuth, Drive, and account behavior. This includes enforcing policies that restrict access to sensitive data across email and Drive, thoroughly investigating OAuth grants to limit exposure, and implementing controls like redacting password reset links or requiring step-up verification for sensitive inbox content. The goal is to establish environmental controls that protect sensitive data regardless of whether the entity attempting access is an attacker or an AI agent operating outside its intended scope.
