Google Workspace Under Siege: Attackers Exploit OAuth Tokens, Bypassing Email Entry Points
Recent breaches at Vercel and Composio reveal a new attack chain targeting Google Workspace, where OAuth tokens, not email, serve as the initial entry point for attackers.
Recent security incidents involving Vercel and Composio have illuminated a significant shift in how attackers are compromising Google Workspace environments. Unlike traditional attack chains that begin with phishing emails and credential theft, these breaches demonstrate a new, more insidious method where OAuth tokens are leveraged as the primary entry point. This evolving tactic bypasses conventional email-centric defenses, forcing a re-evaluation of security perimeters and strategies.
The traditional mental model for workspace security has long centered on email as the primary threat vector. This model assumed that malicious emails would lead to credential theft, followed by account takeovers, and then lateral movement within connected applications. Attackers would exploit compromised inboxes to reset passwords, access sensitive data, and establish persistence. However, the Vercel and Composio incidents, along with a growing number of other tracked breaches, indicate that this paradigm is no longer sufficient.
The new attack chain begins with the compromise of an OAuth token. These tokens, which grant applications permission to access user data and services, are particularly dangerous because they can survive password resets and are often difficult for both users and security teams to detect. When an attacker obtains a stolen OAuth token, they gain direct access to sensitive data stored within Google Workspace applications like Gmail and Drive, effectively bypassing the need to compromise user credentials through email first.
Once access is established via a compromised OAuth token, the attacker can then proceed to take over email accounts. This is a reversal of the traditional flow, where email compromise leads to broader access. From the compromised inbox, attackers can then leverage credentials found in emails or documents, or use email-based password reset mechanisms, to pivot laterally across other connected systems. This sophisticated chaining of exploits allows for deep infiltration and data exfiltration.
Compounding the concern is the parallel between these attack chains and the operational methods of AI agents. Many legitimate AI agents used within organizations operate by design using OAuth grants to access user data from email and Drive. This raises an uncomfortable question: if an AI agent behaves unexpectedly due to ambiguous instructions, unforeseen reasoning paths, or malicious prompts, it could inadvertently follow the same attack path as a human adversary.
Such an AI agent could access sensitive content, process it, and then take downstream actions, potentially leading to data exfiltration or unauthorized access to other systems. This scenario highlights a critical gap in current security controls, which may not be designed to anticipate or prevent actions taken by legitimate, but misbehaving, AI agents operating with broad permissions.
Organizations must therefore rethink their Google Workspace security strategies. Defenses need to extend beyond email security to encompass robust monitoring of OAuth application behavior, strict access controls for third-party applications, and continuous auditing of granted permissions. The rise of AI agents further complicates this, necessitating governance frameworks that can manage and secure these powerful tools, ensuring they operate within intended boundaries and do not inadvertently become vectors for compromise.
The implications of this evolving attack landscape are profound. As attackers become more sophisticated and AI agents become more integrated into daily workflows, the traditional security perimeter is dissolving. A proactive, multi-layered approach that accounts for both malicious actors and the potential for unintended consequences from AI is now essential for protecting cloud-based productivity suites.