The AI tool a colleague connected months ago just became your breach

Some months ago, a colleague wanted to try one of the new AI assistants — the sort that reads your calendar to suggest meeting times, or drafts replies from your inbox. They clicked “Sign in with Google” or “Connect to Microsoft 365”, skimmed the consent screen, approved it, and got on with their afternoon. The tool did its job. Nobody thought about it again.

That approval handed the tool a standing key — an OAuth token — to whatever it asked for: your mail, your files, your calendar. The token doesn’t expire when interest fades. It doesn’t disappear when the person who approved it moves teams or leaves. It sits there, live, until somebody deliberately revokes it.

This is the quiet failure, and it turns someone else’s bad day into yours. When that AI vendor is breached — and in April 2026 a well-known hosting vendor was, with attackers reaching in through exactly this kind of stored token — the attacker doesn’t need to phish your staff or crack a password. They inherit the access you already granted. They log in as you with no password prompt and no multi-factor challenge, because a token that was issued months ago doesn’t face either.

Why it stays invisible

An OAuth grant behaves nothing like a password, and that’s the whole problem.

A password gets changed. An account gets shut off when someone leaves. Your multi-factor authentication (MFA) — the second step, the code or the tap on your phone — stands between an intruder and your data. But an OAuth grant sits beside all of that. The third-party app already holds its token. It doesn’t log in through the front door, so it never meets your MFA prompt and never trips a “new device” alert. It simply keeps using the access it was given.

So when the vendor is breached, the defences you actually think about are never tested. And because each grant was approved by one individual — often with nobody in charge ever seeing it — there’s usually no record that the door exists. Multiply that by every “connect your calendar”, every AI plug-in, every “sign in with Google” a dozen people have clicked over a year, and you have an opening nobody is watching, because watching it was never anyone’s job.

Find it yourself

You can see every app that holds a key to your account, and take back the ones you don’t recognise, in about ten minutes. No tools required — just your account’s security settings.

For a Google / Google Workspace account:

1. Go to myaccount.google.com and sign in.
2. In the left menu, open Security, then scroll to Your connections to third-party apps & services and select See all connections.
3. Work down the list. For each entry, note what it can reach — “Has access to Gmail”, “Has access to Google Drive” is what you’re looking for.
4. Click any app you don’t recognise, no longer use, or can’t account for, and choose Delete all connections (older wording: Remove Access).

For a Microsoft 365 / Outlook account:

1. Go to myaccount.microsoft.com and sign in.
2. Open My apps, or go straight to myapps.microsoft.com, and review the apps listed against your account.
3. For anything unfamiliar, use the app’s menu (the three dots) to remove it. Where an app isn’t listed there, check Manage your account → Privacy / App permissions.

If you run the tenant, the per-user check above only shows one person’s grants. The complete picture lives in your admin console — in Microsoft, Enterprise applications in the Entra admin centre; in Google, Security → API controls → App access control in the Admin console — where you can see every app the whole organisation has authorised.

The fix

Good looks like this: the only apps holding tokens to your mail and files are ones you can name and still use. Anything else is revoked. Revoking a grant doesn’t break the tool for people who genuinely need it — they’ll simply be asked to sign in again next time, which is exactly the moment to decide whether it still deserves the access.

To stop it quietly coming back, set a standing habit rather than relying on memory: put a recurring note in the diary — quarterly is plenty — to walk the connected-apps list for your key accounts. If you run a tenant, turn on admin consent so that new third-party apps need approval before an employee can grant them access, which converts a silent click into a decision someone actually sees.

None of this is difficult, and the check itself is genuinely quick. The uncomfortable part is only ever the first look — the list is usually longer than you expect. After that, it’s a ten-minute tidy you’ll be glad is done the next time a vendor makes the news.

PS — keeping that connected-apps list under control across a whole team, rather than one account at a time, is the sort of thing AuthScope is built to watch for you. Worth a look only if the quarterly manual sweep is more than you want to own.