Topic starter
16/10/2026 9:31 am
TL;DR: Stolen tokens from Drift’s chatbot gave attackers access to more than 700 Salesforce tenants without triggering login-based controls, according to Oak, while weeks of scoping amplified the damage and regulatory exposure. Access review processes assume reachable identities are known and reviewable; undiscovered SaaS grants and token replay break that assumption.
Editorial analysis by NHI Mgmt Group, based on content published by Oak: “700 Companies Were Breached by a Chatbot Nobody Owned”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when a chatbot or vendor integration is not governed as a non-human identity?
A: The control model breaks because the application can keep exercising granted access long after the business context is forgotten.
Q: Why do stolen OAuth tokens create such a broad access risk in third-party integrations?
A: OAuth tokens can act like delegated login credentials across multiple services, so one stolen token may open access to private data in several connected systems.
Q: How should teams detect risky third-party access before it is abused?
A: Look for external identities with broad scopes, long-lived secrets, and permissions that no longer match current contracts or operational need.
Practitioner guidance
- Inventory connected applications as first-class identities List every SaaS-to-SaaS grant, chatbot integration, and vendor application that can reach production data.
- Trace token reach before the next incident For each token-bearing integration, document the downstream systems it can access, the data classes it can query, and the logs needed to prove last activity.
- Move review from people to grants Replace human-only recertification with certification of connected-app grants, service accounts, and vendor-held access.
Bottom line: The core failure is identity governance blind spot, not just token theft or an authentication bypass.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/10/2026 9:32 am
Token replay turns SaaS integrations into governable identities, not just technical dependencies. Once a connected application can act with standing authority, the identity problem moves from user login control to application ownership, scope, and offboarding. The field still treats many integrations as background plumbing, but this incident shows they are active identity subjects with direct access consequences. Practitioners need to classify every externally reachable integration as part of the identity estate.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: When does SaaS integration scoping become a legal and operational problem?
A: It becomes a problem as soon as the organisation cannot answer, quickly, which connected applications can reach sensitive data and what they accessed during the incident window. Slow scoping increases notification burden, complicates accountability, and turns a security event into a governance failure.
👉 Read our full editorial: Chatbot token abuse exposed the limits of identity visibility