The modern attack chain: Rethinking Google Workspace security in the age of AI
Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.
The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.
- Vercel and Composio breaches show one OAuth-first attack chain run twice, with email not the entry point.
- Stolen OAuth tokens survive password resets, rarely expire, and are invisible to unprepared security teams.
- Attackers used tokens to access Gmail and Drive, take over accounts, and pivot laterally via magic links.
- Compromised supplier turns the stolen token into a supply chain attack on the workspace.
- Overpermissioned AI agents with legitimate OAuth grants can walk the same chain without any attacker.
From the original article
7 min read at helpnetsecurity.com
Over the past two months, I’ve written about the Vercel breach and the Composio breach separately. Both offer lessons to learn on their own. But reading them together, I keep coming back to the same observation: these aren’t isolated incidents.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.