OAuth Token Attacks Pave Way for Workplace Breaches
Recent breaches at Vercel and Composio highlight a disturbing trend in workplace security. Instead of exploiting email credentials, attackers are using OAuth tokens to gain access to sensitive data in Google Workspace.
The traditional mental model for workspace security has been that email is the primary entry point for attacks. However, this approach no longer applies as attackers have learned to chain their way through the workspace, rather than relying on a single phishing link or credential steal.
According to experts, these OAuth-centric attacks involve four key stages: using an OAuth token to access sensitive data in Gmail and Drive, taking over email accounts, executing lateral pivots across connected systems, and establishing persistence within accounts.
The problem is further complicated by the increasing use of AI agents in workplaces. These agents are authorized to read email and search Drive on behalf of users but can also behave unexpectedly if their instructions are ambiguous or if they follow a chain of reasoning not anticipated by developers.