Topic starter
06/07/2026 9:36 am
TL;DR: Salesloft’s Drift AI chat integration was breached through stolen OAuth access and refresh tokens, letting attackers access Salesforce directly, harvest customer data, and uncover additional cloud secrets across hundreds of organisations, according to Token Security. The incident shows that machine identities with broad trust can bypass human-centric controls and turn one integration into many downstream compromises.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Salesloft OAuth Breach via Drift AI Chat Agent Exposes Salesforce Customer Data”.
Key questions
Q: What breaks when OAuth tokens are compromised in connected SaaS environments?
A: When OAuth tokens are compromised, attackers can inherit delegated access without defeating passwords or MFA.
A: The exposure created when a SaaS application connects to other systems through OAuth grants, API keys, or automation workflows.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Inventory every SaaS integration token Map OAuth access and refresh tokens to an owner, system purpose, and explicit business justification so no integration remains unclaimed.
- Scope integrations to the minimum Salesforce access Review which objects, queries, and export actions each integration can perform, then remove permissions that are not required for the workflow.
- Separate machine identity reviews from human access reviews Build a governance process that certifies integrations on their own lifecycle, rather than folding them into employee recertification cycles.
Bottom line: This breach exposed how a trusted OAuth integration can function as a machine identity with enough privilege to bypass human-centric access controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:51 am
OAuth token governance failed because the organisation treated delegated access as a technical artifact rather than a first-class identity. That assumption breaks as soon as a token can act with the same trust as an application account and reach customer records at scale. The Salesloft Drift case shows that lifecycle ownership, revocation authority, and permission scoping must be applied to machine identities with the same discipline used for privileged human access.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do first after a third-party integration is compromised?
A: Contain the integration immediately by revoking tokens, disabling related OAuth grants where needed, and checking for related activity across the same trust boundary. Then identify reachable data, review logs for lateral use, and rotate any secrets that may have been exposed through the connected workflow. The first 24 to 72 hours should focus on scope, not theory.
👉 Read our full editorial: Salesloft Drift OAuth breach shows why NHI governance failed