Nobody phished anyone in the Vercel or Composio breaches. That's the part worth sitting with for a second, because for the last decade "security awareness training" has been the default answer to "how do we stop account takeover." Turns out you can skip the user entirely if you just steal the token they already approved.
Context
This isn't new. OAuth token theft and abuse has been a known soft spot since third-party app integrations became a standard part of Workspace and Microsoft 365 environments. Security teams have been quietly worried about "shadow OAuth grants" for years, the same way they worried about shadow IT before that. What's genuinely new here is the shape of the lateral movement: once you're in via a stolen token, you're not just reading email, you're pivoting across Drive, connected apps, whatever that token's scope touches. That's a wider blast radius than a compromised password used to give you, because tokens often carry broader, longer-lived permissions than anyone bothered to audit at grant time.
The AI agent angle is the actual new wrinkle. We've spent years training people not to click suspicious links. We have not spent nearly enough time asking what happens when an AI agent, acting completely as intended, with a legitimate OAuth grant, does something that looks identical to exfiltration from a monitoring perspective. No malware. No malicious insider. Just an agent doing its job with scopes too broad for the task, and nobody watching what it actually did with them.
Hype check
Let's be honest about the framing. "The Modern Attack Chain" sounds like something genuinely novel is happening, and mostly what's happening is: excessive OAuth scopes plus insufficient behavioral monitoring, a problem that predates ChatGPT by half a decade. The vendor angle here (and it is a vendor piece, sponsored, worth saying plainly) benefits from making this sound like a brand new AI-era threat because "AI security" is where the budget conversations are happening right now. Calling it an "attack chain" when half the examples involve zero malicious intent is doing some rhetorical work too.
What's understated: the actual hard problem isn't detecting theft, it's defining "normal" behavior for an agent that's supposed to have broad access and act autonomously. We built anomaly detection models around human behavioral baselines, login times, typical file access patterns, geographic velocity. An AI agent doesn't have circadian rhythms. It might legitimately touch two thousand files in a minute. Your existing UEBA tooling is going to either drown you in false positives or, worse, get tuned so loose it misses the actual exposure event.
Implications
If you're a dev team wiring up AI agents to Workspace, Slack, GitHub, whatever, the OAuth scope you request at integration time is a security decision, not a checkbox to get through onboarding faster. "Read/write access to all Drive files" because it was easier than scoping to a folder is exactly the kind of shortcut that turns into a headline eighteen months later.
For security teams, this is a forcing function to actually inventory OAuth grants across your org (most teams have never done this, I'll just say it) and start treating agent identities as a distinct category from both human users and service accounts. They need their own risk model. Least privilege isn't a new idea but almost nobody enforces it rigorously for OAuth apps, because the friction of re-scoping and re-approving grants is real and teams route around it constantly.
The broader industry implication: identity and access management vendors are going to spend the next two years retrofitting "agent identity" into products built around human and service account paradigms. Some of that will be genuinely useful. A lot of it will be relabeling existing IAM dashboards with an AI icon.
Open question
If an AI agent with a legitimately granted, unrevoked OAuth token quietly exfiltrates or exposes sensitive data while doing exactly what it was authorized to do, is that a security incident, a configuration failure, or just the cost of giving agents real access to real systems, and who in your org is actually supposed to own that distinction today?
— Cor, Skyblue Soft
Sources
AI-assisted draft or imaging, human-curated, reviewed and edited.
Top comments (0)