Google Workspace Attacks Can Start with OAuth, Not Email

The New Attack Chain: Token First, Gmail Later

An analysis published on August 14, 2026, argues that the breaches associated with Vercel and Composio may follow the same pattern: access to Google Workspace does not necessarily begin in the mailbox, but with a compromised OAuth token or an authorized integration.

This distinction changes the traditional account takeover model. In the past, the most common sequence involved a phishing message, credential theft, access to Gmail and Drive, and finally lateral movement to other services. In this scenario, however, the attacker can enter the environment through a connected application and reach email only later.

Email therefore remains central, but not always as the initial entry point. Once accessed, it can become an incident multiplier: it often contains password-reset links, magic links, credentials stored in conversations, and references to internal applications.

The analysis was authored by Rajan Kapoor, VP of Security at Material Security, which also sponsored the publication. Technical details about the Vercel and Composio incidents have not been disclosed: no CVE identifiers, attributed campaigns, or associated threat groups have been reported.

Why OAuth Can Survive a Password Reset

An OAuth token allows an application to act on a user’s behalf according to the permissions defined by its scopes. If the token is stolen, an attacker can use it to access authorized resources without necessarily knowing the password.

This creates an operational challenge for security teams. Resetting the password may not be enough to terminate access because the token may remain valid. According to the analysis, some tokens may also have no obvious expiration and can be difficult to identify when an organization monitors only logins, passwords, and user activity.

The risk increases when the token belongs to a third-party application. A compromised provider or integration can become a supply chain attack, providing seemingly legitimate access to the corporate environment.

The hypothesized sequence is as follows:

1. an OAuth token is compromised;
2. the attacker uses the scopes granted to the application;
3. Gmail and Drive become accessible;
4. the account is targeted without an initial password theft;
5. email and document content is used to reach additional systems;
6. data is collected or transferred to third parties.

The most difficult aspect to detect is the formal legitimacy of the access. The application may be authorized, the token may be valid, and the user may see no obvious warning in their account.

AI Agents Turn Privileges into Automated Actions

The same dynamic can occur without a stolen token. Users are increasingly connecting AI agents to Google Workspace through OAuth, granting them the ability to read email, search Drive documents, and act on behalf of real people.

An agent can therefore access data and services based on its assigned scopes. The issue is not limited to malicious behavior or prompt injection. A system may operate as designed while still having privileges disproportionate to the task it was assigned.

For example, an agent tasked with retrieving information from a mailbox may also be able to access conversations containing credentials or documents stored in shared drives. If it encounters ambiguous instructions, manipulated content, or a decision path not anticipated by its developers, it may use that information to perform subsequent actions.

The chain may include:

• reading messages or folders beyond the required scope;
• identifying credentials, personal data, or confidential information;
• opening links and sending requests to other services;
• moving from one application to another;
• transferring data to a third party.

In this case, an attacker does not necessarily need to control the agent directly. The risk arises from the interaction between overly broad permissions, content present in the environment, and the system’s ability to execute actions automatically.

A human operator with the same privileges may apply internal policies and common sense before using information. An agent, by contrast, tends to execute tasks based on the instructions and access available to it. An OAuth token assigned to a person and one assigned to an automated system may therefore expose similar privileges while enabling very different operating models.

Gmail and Drive Become Expansion Points

In this model, Gmail and Drive are not merely information repositories. They become infrastructure for lateral movement.

A message may contain a password-reset link. A document may include an access key, an operational procedure, or a reference to an internal service. A shared drive may expose data to more users and applications than intended.

As a result, a seemingly limited compromise can spread quickly. Access to an authorized application makes it possible to read content; that content can then provide the means to reach additional accounts and systems.

Potential impact includes email, corporate documents, credentials, personally identifiable information, and data held by connected applications. Automation can increase both the speed and scale of operations, particularly when AI tools help identify useful information and combine it across multiple services.

The source does not assign a formal severity rating or provide indicators of compromise to monitor. It also does not identify affected software versions, specific vulnerable products, or remediation deadlines. The case concerns the access and control model, not a vulnerability identified by a CVE.

How to Reduce Risk in a Workspace Environment

Defensive efforts should not focus solely on anti-phishing filters or user account protection. The first step is to inventory applications, OAuth tokens, and the scopes actually granted, while also reviewing how integrations behave over time.

It is not enough to know that an application is authorized. Organizations must track what data it reads, how often, from which users, and whether its activity changes from the expected pattern. Anomalous access may indicate either the use of a stolen token or a legitimate agent operating beyond its intended task.

Data controls are also necessary:

• identify emails containing credentials, PII, and recovery links;
• review access to shared drives;
• reduce unnecessary OAuth scopes;
• apply least privilege to users, applications, and automated agents;
• monitor sudden changes in integration activity.

Email requires dedicated protection. In addition to blocking phishing, evasive payloads, and attacker-in-the-middle attacks, organizations should prevent a compromised mailbox from automatically becoming an attacker’s operational repository. The most sensitive content can be redacted or placed behind step-up verification before access is granted.

The same rule should apply to AI agents. A system authorized to search email should not be able to retrieve credentials, reset links, or data unrelated to its task without additional controls.

Visibility must ultimately combine email, OAuth, Drive, and account events. Monitoring these elements separately leaves gaps between applications—the very transitions that allow a legitimate or compromised token to turn initial access into data exfiltration and lateral movement.