Key Takeaways
- OAuth refresh tokens granted to third‑party AI, workflow, and productivity apps often persist indefinitely, creating a hidden back‑door that perimeter defenses and MFA cannot stop.
- 80 % of security leaders view unmanaged OAuth grants as a critical risk, yet 45 % of organizations do nothing to monitor them at scale, and another 33 % rely on manual, spreadsheet‑based processes.
- The Drift breach demonstrated that a legitimate app’s stolen OAuth token can be used to exfiltrate data from hundreds of customer environments without triggering any traditional alerts.
- Effective OAuth security requires continuous behavioral monitoring, blast‑radius assessment based on the underlying user’s access, and a graduated response that distinguishes malicious from merely anomalous activity.
- Material Security’s OAuth Threat Remediation Agent provides real‑time visibility, risk scoring, and automated or guided remediation across Google Workspace (and similarly for Microsoft) environments.
Overview of Persistent OAuth Tokens
Every time an employee connects an AI tool, workflow automation, or productivity app to Google Workspace or Microsoft 365, an OAuth refresh token is issued. Unlike a password, this token does not expire when the user leaves the company, does not reset after a password change, and is rarely revoked automatically. Because the token represents a standing grant of access, attackers who obtain it can impersonate the legitimate app and access data without needing credentials or triggering multi‑factor authentication. Most organizations lack visibility into these long‑lived grants, leaving a silent back‑door that perimeter firewalls and identity controls cannot see.
Why OAuth Was Not Built for Today’s Scale
OAuth’s original design assumed a small set of IT‑approved integrations needing limited, well‑scoped permissions. Today, employees independently provision dozens of AI‑driven apps, each receiving a persistent token with scoped but open‑ended access. The protocol itself does not include automatic expiration or centralized cleanup; it merely reflects the consent given at installation. Consequently, the security gap is not a misconfiguration but a systemic mismatch between legacy OAuth assumptions and modern, decentralized app adoption.
Awareness Versus Action: The Quantified Gap
Material Security’s recent research shows that 80 % of security leaders consider unmanaged OAuth grants a critical or significant risk—a concern voiced for years. Despite this awareness, 45 % of organizations take no action to monitor OAuth grants at scale. Another 33 % rely on ad‑hoc methods such as spreadsheets, periodic permission reviews, or employee self‑reporting. These manual approaches provide only a snapshot and fail to detect evolving threats, effectively recording unknown exposure rather than mitigating it.
The Drift Incident: A Concrete Attack Vector
The Drift breach illustrates why OAuth grants are more than a data‑leakage risk—they are an active attack vector. Threat group UNC6395 obtained valid OAuth refresh tokens for Drift, a trusted sales‑engagement platform integrated with hundreds of Salesforce instances. Using these tokens, the attackers accessed Salesforce environments of over 700 organizations, exfiltrating AWS keys, Snowflake tokens, passwords, and other sensitive data. Because the tokens were legitimate and the app was trusted, perimeter controls and MFA saw nothing anomalous. The incident underscores that trust at installation does not guarantee lasting trustworthiness and that OAuth grants require continuous scrutiny.
Limitations of Point‑In‑Time OAuth Tools
Current OAuth security solutions primarily evaluate risk at the moment of grant: checking requested scopes, vendor reputation, and permission excess. While useful for blocking obviously risky apps, they miss threats that arise after installation—such as credential theft, token misuse, or behavioral drift. In the Drift case, the app’s scope and vendor reputation were benign at onboarding; the danger emerged only when the token was later compromised and abused. Therefore, reliance on static reviews leaves organizations blind to post‑grant malicious activity.
What Effective OAuth Monitoring Must Include
To close the gap, OAuth security must move beyond static checks to three core capabilities:
-
Continuous Behavioral Monitoring – Track the actual API calls an app makes over time. Anomalies such as sudden spikes in data reads, queries for unusual object types, or access at odd hours can signal compromise even when permissions appear appropriate.
-
Blast‑Radius Assessment – Evaluate the underlying user account’s access level. A token linked to an executive with years of email and file history poses far greater risk than the same token on a newly created intern account. Risk scores should incorporate the potential impact of a breach based on the account’s data exposure.
- Graduated Response Mechanism – Differentiate between clearly malicious behavior (unknown vendor, excessive permissions, anomalous API patterns from day 1) and subtle deviations in mission‑critical integrations. The former warrants immediate revocation; the latter triggers human review with full contextual data before any action is taken.
Together, these elements enable security teams to distinguish benign noise from genuine threats and respond proportionally.
Material Security’s OAuth Threat Remediation Agent
Material Security addresses these requirements with its OAuth Threat Remediation Agent, which runs continuously across Google Workspace (and can be extended to Microsoft 365). For each OAuth‑connected application, the agent evaluates three interconnected factors:
- Vendor Trust & Scope Analysis – The traditional baseline that flags excessive permissions or low‑reputation vendors.
- Behavioral Monitoring – Ongoing analysis of the app’s API call patterns, comparing them to established baselines to surface deviations.
- Blast‑Radius Assessment – Evaluation of the linked user account’s access to documents, emails, and other resources, quantifying the potential damage if the token is misused.
These inputs are fused into a dynamic risk score that reflects both likelihood and impact. When the score crosses a user‑defined threshold for high‑risk grants, the agent can automatically revoke the token. For lower‑certainty cases involving critical business apps, it creates a detailed ticket for the security team—showing the app’s identity, recent activity, accessed data, and risk rationale—allowing informed, human‑guided decisions. Organizations set their own automation versus escalation lines, keeping analysts engaged where judgment matters while eliminating noise for low‑risk events.
Closing the Back Door: Practical Recommendations
OAuth will remain the default mechanism for third‑party apps to connect to enterprise workspaces, especially as AI adoption accelerates. Rather than attempting to block OAuth grants—a strategy that would hinder productivity and ignore the reality of legitimate, later‑compromised apps—organizations should:
- Deploy continuous monitoring solutions that inspect actual app behavior, not just installation‑time permissions.
- Incorporate blast‑radius analysis into risk scoring to prioritize grants tied to high‑value accounts.
- Implement automated revocation for clear threats while routing ambiguous cases to skilled analysts with rich context.
- Educate employees about the permanence of OAuth grants and encourage periodic review of connected apps, supplemented by automated oversight.
By embracing visibility, behavioral analytics, and responsive remediation, security teams can transform OAuth from a silent liability into a controlled, observable component of their identity infrastructure.
Conclusion
The persistence of OAuth tokens creates a stealthy avenue for attackers that bypasses traditional defenses. While awareness of the risk is widespread, most organizations still lack the capability to monitor and respond at scale. The Drift breach exemplifies how a trusted app’s stolen token can lead to massive data exposure without triggering alerts. Effective defense demands continuous behavioral monitoring, blast‑radius aware risk scoring, and a tiered response strategy—capabilities embodied by Material Security’s OAuth Threat Remediation Agent. Implementing such a framework enables enterprises to reap the productivity benefits of AI and workflow tools while keeping the OAuth back door firmly shut.