Ungoverned AI agents turn OAuth access into NHI breach paths

At a glance

What this is: This is an analysis of the Vercel breach path through a third-party AI agent, OAuth access, and exposed environment variables, showing how ungoverned non-human access can become a lateral movement route.

Why it matters: It matters because IAM, IGA, and PAM teams now need to govern AI agents as non-human identities, not as incidental tools that sit outside inventory, ownership, and enforcement.

Context

The security gap here is not simply compromised access. It is the absence of governance over a third-party AI agent that authenticated through OAuth and could reach internal systems before anyone had clear inventory, ownership, or visibility into what it was allowed to do.

For identity programmes, this is an NHI problem with a human-origin story. The access path moved from a third-party AI tool into an employee account and then into internal environments, which means traditional IAM controls saw the symptom later than the underlying non-human access relationship.

That distinction matters because once an AI agent can authenticate, persist, and spread through connected systems, the programme is no longer managing a single application integration. It is managing a governed non-human identity surface that can create breach paths at machine speed.

Key questions

Q: What breaks when AI agents are not inventoried or classified?

A: When AI agents are not inventoried or classified, organisations lose the ability to assign risk, apply the right obligations, and prove control to auditors. The result is hidden access, inconsistent oversight, and weak accountability when the agent touches regulated data or triggers business actions.

Q: Why do OAuth-connected AI agents increase breach risk in enterprise environments?

A: They inherit delegated trust across applications, so compromise of the agent or its OAuth app can open access to connected systems without re-authenticating each hop. The risk rises when the agent can also reach human accounts or secret-bearing environments, because one trust relationship can expand into many.

Q: How do you know if AI access controls are actually working?

A: They are working only if you can answer three questions consistently: which identity accessed the system, which data it touched, and whether that access matched the intended business use. If audit logs cannot produce that chain, the control is partial and the exposure is still active.

Q: What should teams do when an AI agent can read secrets from environment variables?

A: Treat those variables as high-risk credentials, not configuration data. Reduce the number of readable secrets, remove unnecessary reuse across systems, and revoke any tokens or keys exposed through the agent path so a single compromise cannot fan out into broader access.

Technical breakdown

How third-party AI agents become OAuth entry points

Third-party AI agents often connect through OAuth apps, API keys, or service accounts rather than interactive human login. That makes them look like ordinary integrations while they actually represent delegated access paths with their own trust boundary. In this case, the compromised Context.ai OAuth app created a bridge into Google Workspace and then into Vercel-linked environments. The technical failure is not OAuth itself, but unmanaged delegated access that can be hijacked upstream and inherited downstream by every connected system. Once that trust chain exists, the agent becomes a portable access surface rather than a bounded tool.

Practical implication: treat every OAuth-connected AI agent as a governed identity with explicit ownership and revocation paths.

Why environment variables turn into credential blast radius

Environment variables are often treated as configuration, but when they hold API keys, tokens, or database credentials they become high-value secrets. Even if data is encrypted at rest, any variable not marked as sensitive may still be readable by an attacker who reaches the environment. That is what turns a single compromised integration into broader privilege expansion. The key mechanism is secret reuse across systems: one exposed token can unlock additional services, which lets the attacker move from initial access into escalation without needing a fresh phishing or malware step.

Practical implication: classify environment variables by secret sensitivity and reduce the number of reusable credentials exposed through non-human access paths.

Why traditional IAM misses agent-driven lateral movement

Traditional IAM is designed around inventories of people, groups, and predictable workflows. AI agents operate continuously, connect quickly, and drift across teams, which means their permissions can expand faster than review cycles can capture them. In this breach, the important signals came from a governed human account only after the agentic path had already been used. That is a classic visibility failure: the control plane can log the account event, but not necessarily the originating non-human relationship or the policy violation that enabled it.

Practical implication: extend IAM and IGA coverage to the non-human identities behind agent access, not just the user accounts that consume the alerts.

Threat narrative

Attacker objective: The attacker’s objective was to turn delegated AI access into broader internal access and usable secrets for deeper compromise.

1. Entry occurred through a compromised third-party AI tool whose OAuth app had access to the victim environment.
2. Credential access followed when the attacker hijacked the employee's Google Workspace account and reached connected systems.
3. Escalation happened after readable environment variables exposed API keys, tokens, and database credentials that expanded access.
4. Impact was lateral movement across Vercel infrastructure and exposure of secrets that required rotation and incident response.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ungoverned AI agents create an identity blind spot, not just a security gap. The breach shows that delegated non-human access can sit outside inventory, ownership, and policy enforcement until it is already active inside the environment. That is not a tooling issue alone, but a governance failure to treat AI agents as identities with lifecycle, scope, and accountability. The implication is that AI agent governance has to start before access is granted, not after an alert fires.

OAuth trust is the assumption that breaks when an AI agent becomes the access layer. OAuth was designed for delegated access with clear application ownership, but that assumption fails when the connecting party is a third-party AI agent spreading across teams and systems without stable oversight. The result is a governance model that can authenticate the actor while still failing to understand the actor. Practitioners must rethink delegated trust as a managed identity relationship, not a convenience integration.

Credential blast radius is now a non-human identity problem. The Vercel incident shows that exposed environment variables can carry enough privilege to turn one compromised access path into multiple downstream systems. That is a classic NHI governance weakness because the secret is not just stored, it is reused as an identity carrier across services. The practical conclusion is that secret exposure can no longer be analysed separately from the agent that can reach it.

Identity blast radius is the right concept for agentic environments. When a third-party AI tool can touch environments, tokens, and database credentials, the main risk is not one compromised login but the size of the trust domain that login can move through. The more connected the agent, the larger the identity blast radius created by a single delegated permission. Security leaders should measure agent access by reachable systems and secrets, not by whether the integration was approved once.

Access review alone is too slow for AI agent governance. Traditional IGA assumes the subject under review is stable long enough to be certified. AI agents can be added, changed, and forgotten faster than that cycle. The article reinforces that governance has to combine discovery, enforcement, and revocation in near real time if the organisation wants meaningful control over non-human access.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agentic access has to be governed like any other non-human identity: once a third-party AI tool can authenticate into enterprise systems, the programme needs inventory, ownership, and revocation discipline around that access path. The old assumption that tools are passive integrations no longer holds when the tool can carry delegated access across environments.

This is where NHI programmes and IAM teams converge. The practical question is no longer whether an AI agent was approved once, but whether its current permissions, reachable systems, and exposed secrets are still acceptable today.

For practitioners

• Inventory every third-party AI agent and OAuth app Build a live register of every external AI tool, OAuth app, and agent client connected to enterprise environments, with the systems it can reach and the identities it uses.
• Assign named ownership to non-human access paths Require an accountable system owner for each agentic integration so that approvals, revocations, and exception handling have a clear decision-maker.
• Classify exposed environment variables as secrets Review environment variables for API keys, tokens, and database credentials, then mark them sensitive wherever any non-human identity can read them.
• Add policy enforcement to agent activity Block sanctioned and unsanctioned actions at the agent layer so that access to environments or tools outside policy is visible before downstream alerts fire.

Key takeaways

• The breach path started with delegated AI access, which means non-human identity governance now sits on the critical path for enterprise incident prevention.
• Readable environment variables amplified the incident by exposing API keys, tokens, and database credentials that let the attacker move further.
• Discovery, ownership, and policy enforcement are the controls that would have reduced the blast radius before the compromise became a wider breach.

Key terms

• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Delegated trust: Delegated trust is the decision to let another system or organization issue, validate, or transmit access on your behalf. It is common in cloud and SaaS environments, but it becomes risky when scope, duration, and revocation are not tightly controlled. In NHI governance, delegated trust must be explicit and continuously reviewable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.