Why OAuth grants are difficult for security teams to review

OAuth consent can create lasting connections between workplace apps and corporate data. An employee might grant a note-taking app calendar access or connect a task tool to Slack. These grants are separate from single sign-on (SSO) and multifactor authentication, according to Nudge Security, the article’s author.

The company says disabling an employee in Google Workspace or Microsoft 365 suspends grants issued from that platform, while grants from third-party apps can continue working. Dormant grants may remain valid even without appearing in activity logs. The article cites the Vercel breach, attributing it to a compromised OAuth token from Context.ai, a third-party AI tool connected to an enterprise Google Workspace account.

Nudge Security estimates that a company with 1,000 employees has 88,000 access paths, including 31,000 with direct access to sensitive data. It says a thorough manual review of one grant can take 45 minutes, while its OAuth Grant Risk Analyst agent reached the same verdict in 15 seconds. The agent draws on more than 240,000 vendor security profiles, the company says.

The article describes a workflow in which the agent assesses grants and recommends actions, while a security team reviews the evidence and authorizes any change. Nudge Security says its system can orchestrate actions such as revoking a grant or asking its grantor to justify access. The article is by Nudge Security and appeared on BleepingComputer.