Shadow AI supply chain risk is widening the NHI attack surface

At a glance

What this is: Wing Security says Shadow AI and SaaS integration sprawl are creating unmonitored NHI access paths that can let a compromised OAuth token spread across customer environments.

Why it matters: IAM and NHI teams need to treat app-to-app connections, token scope and third-party offboarding as governance problems, not just SaaS hygiene, because one integration compromise can cascade across the estate.

Context

Shadow AI supply chain risk is the governance gap that emerges when employees connect SaaS apps, AI assistants and third-party integrations faster than security teams can inventory and control them. The primary issue is not the presence of AI alone, but the accumulation of unmanaged non-human identities, delegated tokens and hidden app-to-app trust paths.

Wing Security’s source article frames the Salesloft-Drift breach as a case study in how OAuth tokens, refresh tokens and third-party app connections can extend compromise well beyond the initial vendor. That matters for NHI governance because the exposure is created by standing access relationships that were never fully visible to the owning organisation.

The article’s central claim is that supply chain risk now sits inside everyday productivity workflows. That is typical of modern SaaS estates, where integrations are adopted faster than lifecycle controls are applied.

Key questions

Q: What breaks when shadow AI is not included in identity governance?

A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time. Unmanaged local agents can access cloud and SaaS resources without being enrolled in policy, which means no one can attest to their privileges or revoke them cleanly. The first failure is visibility, and the second is accountability.

Q: Why do OAuth tokens and SaaS integrations create outsized breach risk in connected environments?

A: OAuth tokens can grant persistent, authorized access that looks normal to security controls. Once a token is stolen or a malicious app is approved, attackers can move through connected SaaS apps and extract data through sanctioned channels. The risk grows because one compromise can extend across downstream systems without triggering the alarms teams expect from direct intrusion.

Q: How can security teams tell whether app-to-app trust is outpacing governance?

A: Look for integrations that were adopted by business users, have broad data scopes, or lack a clear owner, review cycle or revocation process. Those are strong indicators that the trust relationship exists outside normal identity governance. If security cannot explain who approved the connection and why, the control has already drifted.

Q: Should organisations treat Shadow AI and SaaS supply chain risk as a third-party access problem?

A: Yes. The practical problem is not just AI adoption, but unmanaged third-party access that inherits enterprise trust through tokens and connectors. Treating it as third-party access forces ownership, review, revocation and offboarding into the same process instead of leaving them scattered across app teams and IT security.

Technical breakdown

How OAuth tokens become cross-tenant trust channels

OAuth tokens are delegated authorisation artefacts, not passwords, but they can still confer broad and persistent access once issued. In SaaS-to-SaaS ecosystems, the token holder is often an integration or app rather than a person, which means the real control plane is the app’s scope, refresh lifecycle and revocation state. If an attacker steals a refresh token, they may not need to authenticate again to continue accessing connected systems. That makes token governance central to NHI security, especially where the integration can read customer records, files or secrets across multiple tenants.

Practical implication: inventory every OAuth-connected app, then restrict scopes and revoke refresh capability where the business does not need persistent delegation.

Why shadow AI expands the NHI attack surface

Shadow AI is unmanaged AI tooling or AI-enabled integrations that appear outside sanctioned governance. These tools often arrive through browser extensions, chat agents or embedded workflow connectors, and they can sit on top of existing SaaS permissions without a new approval path. The security problem is not simply that AI is involved. It is that the organisation loses visibility into which non-human identities are acting, which data they can reach and which downstream systems inherit that trust. In this model, the AI layer amplifies existing SaaS risk rather than replacing it.

Practical implication: discover unsanctioned AI assistants and map their inherited access before they are allowed to connect to production data.

How app-to-app compromise turns one breach into many

Supply chain compromise in SaaS ecosystems works by abusing legitimate trust between services. Once a third-party integration is breached, attackers often pivot through authorised connections rather than attacking the customer directly. That creates a cascade effect where a single compromised vendor can expose multiple downstream environments through shared tokens, service hooks or synchronised data flows. The critical failure is hidden dependency. Security teams may protect the primary application while overlooking the connected apps that inherit its reach. In practice, the attack surface is the trust graph, not the logo on the login page.

Practical implication: maintain a live map of SaaS and AI interconnections so compromised third-party access can be isolated before it fans out.

Threat narrative

Attacker objective: The objective is to turn one trusted integration into broad downstream access that yields sensitive data and reusable credentials across customer environments.

1. Entry occurs through compromise of a third-party SaaS integration linked to AI-powered workflow access, allowing attackers to obtain OAuth and refresh tokens.
2. Credential access is achieved by abusing those delegated tokens to enter customer Salesforce environments without needing separate user credentials.
3. Escalation follows when the stolen access is used to reach sensitive records and adjacent secrets such as AWS access keys, passwords and Snowflake tokens.
4. Impact is the downstream exposure of multiple customer environments, showing how one integration compromise can ripple across a SaaS ecosystem.

Breaches seen in the wild

• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI supply chain risk is really a delegated-trust problem. The article is not describing a new class of malware so much as a new way for ordinary SaaS trust relationships to be abused at scale. When an AI-enabled integration can read, relay or synchronise data across customer systems, the attack surface becomes the full trust graph. Practitioners should stop treating integration sprawl as a procurement issue and treat it as NHI governance with direct blast-radius consequences.

OAuth token sprawl is now a governance control, not an authentication detail. The Salesloft-Drift example shows that token scope, refresh lifetime and revocation speed define how far an attacker can move after the first compromise. That places delegated access under the same scrutiny as any other privileged credential class. The practical conclusion is that token governance must be reviewed alongside privileged access, because the difference between one tenant and many often comes down to a single standing token.

Hidden app-to-app connections create identity blast radius. This is the right named concept for the pattern the article describes: one compromised integration radiates outward through every connected SaaS and AI workflow that inherited its trust. The governance failure is not only lack of detection, but lack of a current trust map. Security leaders should interpret every unmanaged integration as potential blast-radius multiplication.

Shadow AI and SaaS integration risk collapses the assumption that trust is centrally administered. The article shows that employees can create access relationships outside formal oversight, then let those relationships persist in production. That assumption was designed for environments where connections are known, approved and reviewed. It fails when integrations are created opportunistically and can operate autonomously across business systems. The implication is that governance must move from periodic approval to continuous trust discovery.

Supply chain containment now depends on non-human identity lifecycle discipline. The exposure pattern described here is not limited to the initial vendor breach. It depends on how quickly organisations can detect, classify and revoke the downstream tokens and connections they never directly created. That makes offboarding, scope reduction and app-to-app review part of incident readiness, not post-incident clean-up.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: SaaS-to-SaaS and OAuth App Governance Guide

What this signals

Hidden app-to-app connections are the new identity blind spot: when SaaS and AI integrations can be created outside formal approval, security teams lose the ability to reason about who can reach what. That shifts the control problem from authentication to trust discovery and revocation.

Enterprises should expect the governance boundary to move toward continuous discovery of non-human identities, delegated scopes and third-party offboarding. The organisations that can maintain a live trust graph will be better positioned to contain the next integration compromise before it fans out across downstream systems.

For practitioners

• Inventory all SaaS and AI connections Build and continuously refresh a trust inventory for every sanctioned and unsanctioned application, chatbot and integration, including the credentials and scopes each one uses to reach enterprise data.
• Tighten OAuth scope and refresh controls Reduce delegated access to the minimum required, eliminate unnecessary refresh tokens where possible and require explicit review for integrations that can reach sensitive systems or secrets.
• Map trust paths to downstream data stores Document which apps can reach Salesforce, file systems, identity providers and analytics platforms so a compromised integration can be isolated before the compromise fans out.
• Automate token revocation and app isolation Prepare response workflows that can revoke tokens, disable compromised integrations and block risky connections as soon as an exposure alert appears.
• Review third-party access after employee-led AI adoption Treat user-added AI assistants and plug-ins as third-party access events and run the same approval, review and offboarding checks you use for external contractors.

Key takeaways

• Shadow AI turns ordinary SaaS integrations into non-human identity risks when they create unmanaged delegated access across customer environments.
• The Salesloft-Drift case shows how one compromised OAuth token can expose downstream systems and sensitive secrets through trusted app connections.
• The most effective control is a live trust map that pairs discovery with scope reduction, revocation and third-party offboarding.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• OAuth Token: A short-lived access credential issued by an OAuth 2.0 authorisation server granting an NHI scoped access to specific resources for a defined period. Preferred over static API keys because their short lifetime limits the exploitation window if intercepted.
• App-to-app Trust: App-to-app trust is the set of permissions and delegated relationships that allow one software system to act on behalf of another. It is a core NHI risk because it often persists longer than the original business need and is rarely visible in basic application inventories.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.