How OAuth Attack Chains and AI Agents Are Reshaping Google Workspace Security

Rajan Kapoor, Vice President of Security, Material Security

Over the past two months, I have written about the Vercel breach and the Composio breach. Each incident offers important lessons for security teams. Considered together, however, they reveal a broader trend: these were not isolated events.

They were variations of the same attack chain carried out against different targets. Email was not the initial entry point into the workspace. Once that pattern becomes clear, the way organizations approach Google Workspace security must change.

It also raises an uncomfortable question. The attack pattern—using OAuth permissions to access accounts, reading sensitive information from email and Drive, and moving through connected applications—does not describe only attacker behavior. It also resembles what AI agents are increasingly designed to do every day.

Before exploring that connection, let’s examine how the modern workspace attack chain works.

Traditional Google Workspace security models: The danger starts in email

For most of the past decade, the dominant model for workspace security has been simple: email is dangerous, while the rest of Google Workspace is comparatively safe.

This approach made sense when attackers primarily relied on phishing to steal credentials. That threat remains important, but attackers have learned to move through connected applications and cloud workspaces instead of relying solely on inbox compromise.

The traditional attack chain typically looks like this:

• Email is the entry point. Phishing links, malicious attachments, convincing social-engineering messages, and prompts designed to manipulate AI agents initiate the attack.
• Credentials are stolen. The attacker obtains valid credentials and takes control of the user account.
• Sensitive data is accessed in Gmail and Drive. After compromising an account, the attacker can access information stored across Google Workspace.
• Lateral movement begins. Access to an inbox can expose password-reset messages, magic links, credentials, and other paths into connected applications.
• Persistence is established. Attackers may remain undetected for days, weeks, or months while quietly monitoring and exfiltrating sensitive data.

Together, these steps form a familiar account takeover (ATO) scenario. The attack begins with an identity compromise through email and expands across the workspace.

The evolving attack chain: OAuth becomes the entry point

The components of a workspace attack have not changed, but their order has. The incidents involving Vercel, Composio, and other organizations show that modern attacks may not begin with email at all.

Instead, the OAuth token becomes the gateway to email and Drive—not the other way around.

Modern OAuth-based attacks commonly follow this sequence:

• OAuth becomes the entry point. Attackers establish persistence using stolen OAuth tokens. These tokens can survive password resets, remain difficult to detect, and operate without obvious user activity. In some cases, a compromised supplier or third-party application provides the path into the organization, turning the incident into a supply-chain attack.
• Sensitive data is accessed. Attackers use the stolen OAuth permissions to access information stored in Gmail, Google Drive, and other connected services.
• The email account is effectively compromised. Account takeover occurs through OAuth rather than through a stolen password. Once email is accessible, the incident can expand significantly.
• Lateral movement follows. Attackers can use credentials stored in Drive, password-reset messages, and magic links to move between connected systems.

The elements of the workspace attack chain are likely to remain consistent. However, attackers using AI tools will continue to identify vulnerabilities, automate activity, and recombine these steps at greater scale.

OAuth-centric attacks are one example of this continuing evolution.

The same attack chain, with a different actor

Now consider the same four-step process from the perspective of an AI agent.

Employees are increasingly connecting AI agents to Google Workspace. These agents use standard OAuth permissions, read email, search Drive, and perform tasks on behalf of users. In many organizations, this adoption is happening faster than security teams can inventory and monitor it.

If an AI agent behaves unexpectedly—because its instructions are ambiguous, its reasoning produces an unforeseen result, or it encounters malicious content in the environment—it may follow a path that looks remarkably similar to an attacker’s.

• It may access an inbox or Drive folder that was not required for the task because its OAuth scope is broader than necessary.
• It may read and use sensitive information, including credentials in email threads or confidential documents in shared drives.
• It may take downstream actions, such as sending messages, following links, or making requests to other services.
• It may move laterally between applications and expose sensitive information to third parties.

In this scenario, there is no malicious attacker and no stolen password. The AI agent is simply operating with excessive access in an environment that lacks the controls needed to stop unintended behavior.

Why AI agent security requires full-chain protection

Many discussions about AI agent security focus on preventing prompt injection, red-teaming AI systems, and reviewing the applications employees connect to their accounts. These are important security measures, but they do not address the entire problem.

The risk described here is not necessarily that an AI agent will be weaponized. It is that an agent may behave exactly as designed in an environment where existing guardrails were not built for highly privileged, automated actors.

Human users operating with excessive privileges may recognize that an action violates company policies or common sense. An OAuth token granted to an AI agent has the same access rights as one granted to a human, but the agent may not recognize that it is over-authorized. It is simply trying to complete the assigned task.

The most important controls, therefore, are not limited to the agent itself. They must also protect the environment in which the agent operates.

When security teams understand where sensitive information resides in Gmail and Google Drive, they can apply policies that restrict access before an attacker or an AI agent reaches it. By monitoring OAuth permissions and application behavior, teams can identify and limit exposure to compromised applications, attackers, and unintended agent activity.

Similarly, if password-reset links are protected and step-up verification is required before sensitive email content can be accessed, an attacker—or an AI agent acting outside its intended scope—cannot easily use that information as a pivot point.

The same security coverage that protects against modern attack chains can also reduce AI agent risk. The underlying problem is the same; only the actor is different.

What does full-chain Google Workspace protection look like?

The answer is not necessarily more point solutions at every stage of the attack chain. Organizations need visibility across the entire chain—email, OAuth, Drive, application activity, and account behavior—so security teams can connect the signals before an incident reaches the later stages of compromise.

Here is how Material Security addresses each stage:

Block malicious email payloads. Material email security is designed to detect threats that native controls may miss, including advanced phishing, payloads that bypass reputation-based filtering, and man-in-the-middle attack techniques. Preventing malicious messages from reaching users remains one of the most effective ways to stop an attack before it begins.

Detect suspicious OAuth behavior. OAuth security should do more than list connected applications and their permission scopes. The Material OAuth security platform monitors what applications actually do, including what they read, when they access information, and how their behavior changes over time. Activity-level anomalies can reveal risk whether an OAuth token is being used by an attacker or by an AI agent operating outside its intended parameters.

Discover and protect sensitive data at rest. Organizations cannot protect data they cannot locate, and they cannot create effective access policies without understanding how information is exposed.

With Material file security, teams can identify sensitive data across Gmail and Drive. Security teams can see which shared drives have broad access, which email threads contain credentials or personally identifiable information (PII), and which Drive folders are accessible to unintended users. This visibility supports least-privilege access for human users, applications, and automated agents.

Limit lateral movement through password-reset protection. Material can redact sensitive content in messages, including password-reset links, and require progressive verification before that information becomes available.

If a reset link is not visible in plain text, an attacker with inbox access cannot easily use it to compromise another account. The same protection applies when an AI agent searches an inbox for information needed to take further action.

The pattern will continue

Vercel and Composio are likely only the beginning. The list of incidents will continue to grow, and future cases may not fit neatly into the category of “external attacker.”

Some incidents may involve AI agents taking unexpected actions. Others may involve overprivileged integrations accessing data they were never intended to see. The mechanics will look familiar even when the actor and circumstances are different.

The answer is not to fear AI agents or delay their adoption. AI agents can deliver significant productivity benefits.

The right response is to recognize that the workspaces where these agents operate require security controls designed for a world in which OAuth-authenticated software—authorized or compromised—is a first-class actor.

If your Google Workspace security strategy ends with email, gaps remain. Those gaps are where modern attack chains are executed—and where AI agents can operate outside their intended scope.

If you want to learn more about full-chain Google Workspace security, contact Material Security.

Sponsored and written by Material Security.