AI supply chain trust gaps expose enterprise OAuth access

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Anjuna's blog post: An ungoverned agent, an over-permissioned OAuth grant, and compromised vendor credentials enabled enterprise access and lateral movement in an AI supply chain breach.

Why it matters: It matters because IAM teams now have to govern not just human and machine access, but the trust grants, scopes, and runtime behaviour of AI agents that can outlive the assumptions behind traditional access control.

Context

The security gap here is not simply credential theft. It is the assumption that an AI agent can be trusted with enterprise access once, then left to operate inside the same governance model used for human users and ordinary service accounts.

In practice, that breaks down when external tools are granted broad OAuth scopes, when approval is skipped, and when nobody maintains an inventory of which connected agents hold enterprise credentials. Agentic AI identity has to be governed as a distinct identity problem, not a side effect of software adoption.

This breach is therefore best read as a governance failure in the trust chain, not as a novel exploit. The compromise started outside the enterprise, but the blast radius expanded because the organisation treated an unverified agent like a trusted integration.

Key questions

Q: What breaks when AI agents are given broad enterprise access without tight governance?

A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene. The failure is not only misuse by an attacker. The system itself can exceed intended scope during normal task completion, so the real control problem is bounding authority before runtime action begins.

Q: Why do connected AI tools increase enterprise breach impact?

A: They increase impact because a compromise in the vendor or agent layer can inherit existing corporate trust relationships. If the connected tool holds delegated credentials, the attacker does not need to re-authenticate the employee. The breach then expands through legitimate access paths that were never designed for autonomous or semi-autonomous use.

Q: What are the signs that an AI security agent is failing governance review?

A: Common warning signs include unclear retry behaviour, no fixed scope boundaries, mixed operator intervention, and logs that cannot reconstruct each action. If the team cannot explain what the agent was allowed to do and prove what it actually did, governance is not working.

Q: What should hospitals do when an AI agent is compromised?

A: Immediately revoke the agent’s credentials, stop downstream workflow execution, and isolate any system that accepted the agent’s actions as trusted input. Then review what data was accessed, which workflows were triggered, and whether the agent had permissions wider than the task required.

Technical breakdown

How infostealer malware turned a vendor foothold into OAuth token theft

The first stage was classic credential harvesting. A developer infected their own machine with infostealer malware, which exfiltrated logins, cloud service keys, and other secrets. That access then let the attacker reach the AI tool vendor's cloud environment and steal OAuth tokens issued on behalf of customers. The important mechanism is delegation: once a third party holds tokens tied to customer trust, the compromise boundary moves from the end user to the vendor relationship. In identity terms, the attacker did not need to break the target account first. They only needed one upstream compromise and one trust relationship that was already in place. See the AI Coding Agents Security Guide.

Practical implication: Map which external tools hold delegated access on your behalf and treat those tokens as part of your exposure surface.

Why enterprise OAuth grants become blast-radius amplifiers

The second mechanism is scope inflation. An employee connected the compromised tool to enterprise Google Workspace with an Allow All grant and no IT review. That means the initial trust decision was broader than the business need, so when the vendor was breached the attacker inherited enterprise-level access through the existing delegation. This is a familiar NHI pattern: the credential itself may be valid, but the authorization boundary is far too wide. Once a token can read environment variables or reach production APIs, the identity problem becomes one of containment rather than authentication. See the AI Agent Authorisation Guide.

Practical implication: Limit connected-app scopes to the minimum required and review every enterprise OAuth grant as a governed identity relationship.

Why the runtime layer, not the login layer, determined the final impact

The final stage shows why control at issuance time was not enough. After gaining valid credentials, the attacker moved laterally into production, read plaintext environment variables, and exposed internal databases and customer credentials. That means the runtime environment allowed sensitive values to remain reachable once access was granted. In agentic and machine-mediated workflows, the critical control is often not the initial authentication event but the boundary around what the session can enumerate, read, and export. If secrets are visible in the runtime plane, any trusted identity can become an escalation path. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Isolate secrets and sensitive configuration from the execution environment so valid access does not become unrestricted discovery.

Threat narrative

Attacker objective: The objective was to pivot from one compromised vendor trust relationship into broad enterprise access and monetisable data theft.

1. A developer at an AI productivity tool company infected their machine with infostealer malware, which exfiltrated credentials, Google Workspace logins, and cloud service keys.
2. The attacker used those stolen credentials to access the AI tool vendor's cloud environment and exfiltrate OAuth tokens issued on behalf of customers.
3. An employee had connected the compromised tool to enterprise Google Workspace with broad trust, so the attacker inherited enterprise access through the delegated agent relationship.
4. With valid enterprise credentials, the attacker moved into production, exposed secrets and internal data, and expanded the breach into customer credential compromise.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Hugging Face API tokens exposed 2023: Lasso Security found 1,681 live Hugging Face tokens in public code, 655 with write access, reaching 723 organisations including Meta; all were revoked.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ungoverned AI agents create an identity trust chain that existing IAM models do not fully describe. This breach did not depend on a zero-day or a novel exploit. It worked because an organisation treated an unverified agent like a routine integration, then allowed that trust to extend into enterprise Google Workspace without clear ownership, inventory, or approval. The practitioner lesson is that delegated access must be governed as an identity relationship, not a one-time software connection.

Blast-radius control is now a first-class identity requirement for AI-connected access. Once a vendor-held OAuth token can reach production systems, the failure is no longer just authentication. It is the absence of containment around what the session can see, enumerate, and exfiltrate. That is why incident response for AI agents and runtime containment matter alongside provisioning controls. Practitioners should treat runtime reachability as the decisive security variable.

Traditional IAM assumptions collapse when an AI agent can operate with human-level trust grants at machine speed. Access review processes were designed for privileges that persist long enough to be observed and certified. That assumption fails when an agent can inherit, use, and abuse access inside a short-lived trust chain before governance ever sees the state change. The implication is that governance must move closer to issuance, delegation, and runtime policy.

Vendor compromise is now a direct enterprise identity problem, not just a supply chain problem. The breach shows how third-party access can turn upstream compromise into downstream enterprise exposure when AI tools are allowed to hold corporate credentials without a managed lifecycle. The named concept here is delegated trust without lifecycle control: access outlives the oversight that was supposed to contain it. Practitioners need to treat connected agents as governed identities with explicit offboarding and scope review.

AI agent governance has to connect identity, policy, and runtime isolation in one control plane. The article's central point is not that AI tools are uniquely dangerous, but that ordinary trust grants become structurally unstable when they are extended to software that can act autonomously and move across systems quickly. The implication is to align identity governance with runtime enforcement, because one without the other leaves a gap attackers can exploit.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Agentic AI Identity Guide

What this signals

Delegated trust without lifecycle control: The real governance gap is not AI capability, but the way connected tools inherit access that no one can later explain, certify, or offboard cleanly. Once that happens, the identity boundary shifts from the employee to the agent, and the enterprise loses visibility into who can still act on its behalf.

Enterprise programmes should expect AI-connected access to behave like a fast-moving NHI estate: ownership changes, scope expands, and the runtime state can outrun review cycles. The control point has to move closer to consent, delegation, and revocation, or review processes will always arrive after the trust decision has already been exploited.

AI supply chain risk is becoming an identity governance issue because third-party tools can hold the credentials that unlock production systems. Security leaders should prepare for agent inventories, delegated access registers, and stronger offboarding discipline across the full trust chain.

For practitioners

• Audit connected AI tools and delegated OAuth grants Inventory every external AI tool holding enterprise credentials, identify the business owner, and revoke any grant that lacks a documented purpose or approval path. See the Shadow AI and AI Agent Discovery Guide.
• Shrink enterprise OAuth scopes to task necessity Replace Allow All style grants with minimum-scope authorisations and require explicit review before an agent can access mail, files, or production-adjacent data.
• Separate secrets from readable runtime state Keep environment variables, API keys, and customer credentials out of plain runtime access paths so a valid session cannot enumerate sensitive values by default.
• Establish an offboarding path for compromised agents Define how a connected agent is disabled, how its tokens are revoked, and how downstream access is traced when the vendor or tool is compromised.

Key takeaways

• The breach shows that AI agent trust can become an enterprise identity problem when delegated access is broad and poorly inventoried.
• The attack chain moved from malware on a developer laptop to vendor token theft to enterprise-level OAuth abuse and production exposure.
• Containment, scope reduction, and explicit offboarding are the controls that matter most when connected agents can hold corporate credentials.

Related NHI Mgmt Group resources: AI Coding Agents Security Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Shadow AI and AI Agent Discovery Guide

Key terms

• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Agent Governance: Agent governance is the set of policies, controls, and evidence required to manage autonomous software as a non-human identity. It covers consent, tool access, lifecycle review, audit logging, and revocation so that an agent remains bounded as its workflows change.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.