AI drive enumeration exposes the gap in data context controls

At a glance

What this is: This analysis shows how an AI-to-drive OAuth integration can enumerate hundreds of internal files in milliseconds when data context controls do not travel with access.

Why it matters: It matters to IAM, PAM, data security, and AI governance teams because approval of an integration is not the same as governing what the integration can see, copy, or process.

Context

AI-driven access problems are now as much a data governance issue as an authentication issue. When a machine process can enumerate files through an approved integration, the control question shifts from who logged in to what the data was, who authorised it, and whether those permissions still match the business context.

Traditional DLP, endpoint, and SIEM tooling were built to watch human behaviour on browsers and devices. That model breaks when access happens server to server through OAuth tokens, because the security stack may see legitimate API activity while missing the fact that sensitive content is being broadly exposed.

This is a genuine data context and governance gap, not a narrow product quirk. The article’s starting position is typical of modern SaaS estates: access is granted at the integration layer, while protection is still expected to be implied rather than persistent.

Key questions

Q: How should teams handle AI integrations that can enumerate internal files through OAuth?

A: Treat the integration as a governed data path, not just an approved app. Limit the scope to the minimum file set, require classification-based policy enforcement, and make sure sensitive content keeps its protections when accessed through APIs or AI backends. Approval should validate business need and data class, not only vendor trust.

Q: Why do AI data programs create security risk even when access is approved?

A: Because approval alone does not prove the data is appropriate for AI use. If the data is poorly classified, inconsistent, or insufficiently monitored, approved access can still expose regulated or sensitive information at scale. The control failure is in the quality of the underlying governance context.

Q: What are the signs that data context controls are failing for AI access?

A: Look for broad repository enumeration, large numbers of parallel API calls, stale OAuth grants, and files of very different sensitivity being treated the same way. Those signals show that approval exists, but classification and rights enforcement are not influencing what the integration can actually do.

Q: Should organisations prioritise integration approval or file-level protection first?

A: File-level protection should come first for the most sensitive content, because approval processes cannot reliably predict every downstream AI access pattern. If the data already carries persistent controls, a later integration is constrained by policy rather than by optimism. Approval is useful, but it is not sufficient on its own.

Technical breakdown

Why OAuth access can enumerate more than intended

OAuth is an authorisation framework, not a data governance layer. Once a user approves a scope, the connected application can call APIs within that scope regardless of whether each file should be equally accessible from a business-risk perspective. In AI workflows, that means a chatbot or backend service can query large portions of a repository with valid credentials, even when the operator intended a narrower use case. The security gap is not only permission breadth. It is the lack of per-object context, such as classification, ownership, retention, and regulatory treatment, at the moment of access.

Practical implication: Treat approved OAuth scopes as a starting point, not as proof that the downstream data access is safe.

Why server-to-server AI activity bypasses conventional detection

Server-to-server requests often look clean to controls that expect human endpoints, browsers, or interactive sessions. An AI backend can make hundreds of parallel API calls from cloud IP space without the endpoint signals, browser telemetry, or user interaction patterns that many security tools depend on for anomaly detection. That changes the detection problem from behaviour analysis to data-aware authorisation. If the access path is legitimate but the data is sensitive, the decision point has to move closer to the file itself, not to the device or session alone.

Practical implication: Build detections and policy enforcement around data exposure, not just around user-device activity.

How persistent rights management changes the control model

Persistent rights management attaches protection to the file itself, so the control follows the data after discovery, sharing, or enumeration. That matters when AI systems can rapidly locate sensitive files, because classification alone does not stop disclosure. The stronger model combines content classification, contextual policy, and enforcement that still applies when files are copied, moved, or accessed through an AI integration. In practice, this is the difference between knowing a file is sensitive and actually constraining what an AI service can do with it.

Practical implication: Use file-level controls that preserve policy after the data leaves the original application boundary.

Threat narrative

Attacker objective: The objective is rapid, silent enumeration of internal content at scale through legitimate access paths, not a classic intrusion that trips perimeter controls.

1. Entry via an approved ChatGPT to Google Drive OAuth integration gave the backend valid server-to-server access.
2. Credentialed access let the AI backend enumerate more than 400 internal files in parallel within 42 milliseconds.
3. The impact was broad repository exposure of product, financial, customer, and security content with no human alert or browser signal.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Persistent data context is now a governance control, not an optional enhancement. When AI can retrieve data through approved integrations, the control boundary has shifted from the login event to the file itself. Classification, rights, ownership, and regulatory handling must travel with the content or the enterprise will continue to approve access it cannot meaningfully govern. Practitioners should treat data context as part of the access model, not as a reporting afterthought.

AI enumeration exposes the weakness of human-centred security assumptions. Most enterprise control stacks still assume a person, a device, and an observable session. AI backends break that assumption by acting through tokens and APIs at machine speed, often from cloud infrastructure that looks legitimate. That means DLP, SIEM, and endpoint-only thinking will miss the exposure pattern unless policy enforcement moves down to the data layer.

Semantic classification is the named concept that this article sharpens. Content alone is not enough, because a roadmap, a security procedure, and a customer plan can all be “documents” while carrying very different obligations. Semantic classification combines content, context, and intent so the enterprise can distinguish high-risk files from ordinary ones before an integration touches them. Practitioners should build classification around meaning, not just keyword detection.

OAuth approvals create entitlement, not suitability. The governance mistake is assuming that reviewed permissions equal acceptable data use. In reality, the approval step often validates the vendor relationship while leaving file-level exposure unchanged. This is a classic mismatch between identity governance and data governance, and it demands tighter policy linkage between integration approval, data classification, and revocation of stale access.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Data context debt: enterprises now face a gap between access approval and content-level control, and that gap becomes most visible when AI backends can enumerate repositories faster than teams can review them. Security leaders should assume that any AI integration touching shared storage will expose weak classification, stale grants, and missing rights management long before an endpoint alert fires.

The practical response is to move policy closer to the file and away from the session. That means persistent controls, classification fidelity, and integration review tied to data sensitivity rather than application convenience. Teams that keep treating OAuth consent as the control boundary will continue to discover exposure only after the data has already been reached.

For practitioners

• Tighten integration approval around data classes Require every AI and collaboration integration to declare the file classes it may access, then block broad repository enumeration where sensitive or regulated content is present.
• Apply persistent rights to sensitive files Use file-level rights management so sensitive documents remain constrained after they are discovered, copied, or processed by an AI backend.
• Review dormant and stale OAuth grants Find integrations still authorised after team changes, role changes, or offboarding, and revoke tokens that no longer match business need.
• Classify content before AI access is approved Prioritise discovery and classification of files that hold product, financial, customer, or security data so policy can be enforced before AI touches them.

Key takeaways

• The article shows that AI access can be fully authorised and still be unsafe when data context is absent at the file level.
• The core failure is not the AI query itself but the mismatch between integration approval and persistent protection for sensitive content.
• Enterprises should align classification, rights management, and revocation with the data object, because human-centred controls do not reliably govern server-to-server AI access.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the data and integration risks that now shape AI-enabled environments.