# OAuth-Token Supply-Chain Compromise Enables Attacker Access to Google Workspace: The Vercel and Composio Breaches

> Material Security VP Rajan Kapoor documents a shift in Google Workspace attacks from password-based account takeover to OAuth-token-based intrusion, citing the Vercel breach (a Context.ai OAuth token pivoted into Vercel's Workspace via an over-scoped 'Allow All' grant) and the Composio breach (a stolen Gmail OAuth token used to intercept magic-link sign-in emails, escalate through an agentic monitoring tool, and reach a tool-execution sandbox) as concrete cases of this pattern. Both incidents show a stolen or over-granted OAuth token functioning as a long-lived, password-reset-resistant credential that lets an attacker read Gmail/Drive content and pivot laterally using in-mailbox secrets and password-reset links, behavior the article argues is largely indistinguishable from legitimate AI-agent activity.

- **Published:** 2026-08-14T00:00:00Z
- **Last reviewed:** 2026-08-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2018
- **ID:** TL-2026-2018
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat documents an emerging OAuth-token-centric attack pattern against Google Workspace tenants, evidenced by two disclosed 2026 supply-chain breaches. In the Vercel case, a Context.ai employee endpoint was infected with Lumma Stealer infostealer malware in February 2026 via a trojanized Roblox 'auto-farm' cheat download, exfiltrating Google Workspace, Supabase, Datadog, and Authkit credentials, including access to the shared support@context.ai account. Separately, a Vercel employee had signed up for Context.ai's 'AI Office Suite' using their Vercel enterprise Google account and granted the app 'Allow All' OAuth permissions against Vercel's enterprise Google Workspace. The attacker used the Context.ai foothold to pivot through this over-scoped grant into Vercel's internal Google Workspace, then enumerated and escalated access into internal Vercel systems, reading environment variables (API keys, tokens, database credentials) that had not been flagged as 'sensitive'. A threat actor using the ShinyHunters name claimed responsibility on BreachForums and demanded $2 million for the alleged data, but Google Threat Intelligence Group assessed the claimant as likely an imposter using an established group's name; no confirmed attribution exists. Vercel disclosed the breach April 20-21, 2026, worked with Mandiant, Microsoft, GitHub, npm, and Socket, found no evidence of compromised npm packages, and now defaults deployment environment variables to 'sensitive'.

In the Composio case, disclosed May 21, 2026, an attacker compromised a Composio employee's Gmail OAuth token, gaining inbox access sufficient to intercept magic-link sign-in emails. This let the attacker authenticate into an internal agentic monitoring tool used to watch for connector failures, then abuse that tool's broad permissions to reach an automated remediation system. The attacker registered malicious tool definitions inside Composio's tool-execution sandbox, achieving arbitrary code execution, then pivoted to an auxiliary credential cache and exfiltrated customer secrets to commercial VPN endpoints. Disclosed impact: roughly 5,241 API keys and 5,001 GitHub OAuth tokens (revoked as a precaution), plus roughly 12 Gmail tokens and smaller sets of tokens for Jira, Slack, HubSpot, Linear, Notion, Google Calendar, Vercel, Sentry, Google Drive, and Bitbucket. Composio has not disclosed what data the attacker actually accessed with the stolen tokens, and no threat actor has been publicly attributed.

The common thread Material Security highlights, and the reason this is filed as a distinct threat rather than a restatement of either breach: OAuth grants survive password resets, don't expire on their own, and are hard to observe at the activity layer — making attacker use of a stolen or over-scoped token functionally indistinguishable from an AI agent legitimately using the same grant to read email and Drive content and act on what it finds.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1176 Software Extensions
- T1548 Abuse Elevation Control Mechanism
- T1550.001 Application Access Token
- T1555.003 Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1087.004 Cloud Account
- T1069.003 Cloud Groups
- T1078.004 Cloud Accounts
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service

## Sources

- [The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI](https://www.bleepingcomputer.com/news/security/the-modern-attack-chain-rethinking-google-workspace-security-in-the-age-of-ai/)
- [Vercel breached via compromised third-party AI tool](https://www.helpnetsecurity.com/2026/04/20/vercel-breached/)
- [Vercel Breach Analysis: How an OAuth Token Became an Identity Attack Path](https://specterops.io/blog/2026/04/21/the-vercel-breach-explains-why-identity-attack-path-management-cant-wait/)
- [Unpacking the Vercel breach: Shadow AI and OAuth sprawl](https://pushsecurity.com/blog/unpacking-the-vercel-breach)
- [Vercel breach tied to Context AI hack exposes limited customer credentials](https://thehackernews.com/2026/04/vercel-breach-tied-to-context-ai-hack.html)
- [AI cloud company Vercel breached after employee grants AI tool unrestricted access to Google Workspace](https://www.tomshardware.com/tech-industry/cyber-security/vercel-breached-after-employee-grants-ai-tool-unrestricted-access-to-google-workspace)
- [Single token got Vercel hacked: 'Allow all' OAuth](https://cybernews.com/security/vercel-hacked-after-oauth-compromise/)
- [The Composio Breach: One Token, 10K Doors](https://material.security/resources/the-composio-breach-one-token-10242-doors)
- [Composio May 2026 Security Incident](https://composio.dev/blog/composio-may-2026-security-incident)
- [Composio Security Incident: What Happened and What AI Agent Teams Should Do Now](https://metorial.com/blog/composio-security-incident-mcp-security)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2018