OAuth Tokens Are Quietly Becoming the Skeleton Key to Google Workspace

Key points

• Attackers are breaking into Google Workspace accounts without needing a password, by stealing OAuth tokens, the digital passes that third-party apps use to access Gmail and Drive on a user's behalf.
• Once a token is stolen, the attacker can read email and download files while looking like a legitimate signed-in session.
• Security firm Material Security argues defenders keep focusing on the login step and missing the rest of the chain.
• AI assistants plugged into Workspace expand the blast radius, because a single stolen token can now feed a bot that summarises an entire mailbox in seconds.
• Standard multi-factor authentication does not stop a token that has already been issued.

Most people picture a Google Workspace break-in the same way: a fake login page, a stolen password, a scramble to reset it. That story's only half right. A quieter path is doing real damage, and it doesn't touch the login screen at all.

Security vendor Material Security, in analysis picked up by BleepingComputer, is pushing defenders to look at the full attack chain against Workspace, not just the front door. The failure mode is simple. Once a user clicks "Allow" on a third-party app, Google issues an OAuth token. That token, think of it as a hotel keycard the app keeps in its pocket, lets the app read mail or files without asking for the password again.

Steal the keycard and you skip the lobby.

How do attackers actually get in without a password?

They trick users into approving a malicious app, or they grab tokens from a machine that's already infected. Neither step involves guessing a password or defeating multi-factor authentication, the extra code from a phone that's meant to stop account takeovers.

In practice, the con looks like a normal app consent screen. A user sees a request from something called "Docs Reviewer" or "Calendar Sync Pro" and clicks through. Behind that button, the app is asking for permission to read every email in the mailbox. Google honours the request because the user honoured it. The attacker's traffic then looks like a legitimate app doing legitimate work.

Inforstealer malware, small programs that scrape saved credentials and session data from a browser, is the other big supplier. It lifts tokens straight off the endpoint and ships them to a criminal marketplace.

Why does AI make this worse?

Because AI assistants now sit on top of Workspace with the same tokens. We looked at exactly this dynamic on 29 July in "AI agents with too many keys", and the permissions problem hasn't shrunk since. A stolen pass that used to grant a slow, manual read of a mailbox can now feed a language model that summarises years of email in minutes. Sensitive data leaves faster and in a more useful shape for the buyer.

That's the part vendors tend to gloss over in the AI pitch. The permissions model wasn't rethought when the assistants arrived. It got extended.

Should you worry if you're not an IT admin?

Yes, because the exposure lives in your personal consent history too. Go to your Google Account, then Security, then "Your connections to third-party apps and services". Anything you don't recognise, remove. Do the same for your work account if your employer allows it.

If your organisation runs Workspace, the operational picture is uglier. Admins should be pulling the OAuth app inventory regularly, restricting which scopes third-party apps can request, and treating a new high-privilege consent grant as an event worth investigating, not a log line to archive.

One thing the post-mortem will say: the login was fine. The consent screen was the breach.

Watch the scope grants on your AI integrations. That's where the next significant incident in this class is most likely to originate.