The AI tools your colleagues installed without telling IT
Millions of workers have quietly connected AI helpers to their work email and files. Most companies have no idea what is running, or what it can do.
Key points
- AI agents, software that takes actions on your behalf rather than just answering questions, are spreading inside company systems without IT approval.
- Most connect through OAuth, the standard "Allow this app" permission screen, which can hand an agent long-term access to email, calendars and files in two clicks.
- A refresh token, a long-lived digital key created during that approval, lets an agent keep logging in for weeks or months without asking again.
- The majority of companies have no central list of which agents are active, who approved them, or what permissions they hold.
- Both Google and Microsoft give every user a page where they can see and remove connected apps right now.
Somewhere in your company, someone clicked "Allow" on an AI tool last week. They meant well, found something that drafts emails or schedules meetings, signed in with their work account, and got back to their day. The permissions screen they didn't read quietly handed that tool access to their inbox, their calendar and a shared drive.
As first reported by ThreatVectr, this is now a pattern across companies of every size, playing out inside Google Workspace, Microsoft 365 and Salesforce.
What exactly is an AI agent, and why does it need your password?
An AI agent isn't a chatbot. A chatbot answers questions. An agent acts: it books meetings, files expenses, moves files between apps. To do any of that, it needs to log in as you, or alongside you.
The login happens through OAuth, the mechanism behind every "Sign in with Google" button you've ever clicked. Its technical reference is RFC 6749, but you already know how it feels: a screen lists what the app wants, you click approve, done.
What gets created in the background is a refresh token. Think of it as a spare key the agent uses to keep logging back in, automatically, for weeks or months, without another prompt from you. Multifactor authentication, the six-digit code your employer probably requires, doesn't help here. You already passed that check when you clicked approve. The agent's key works without you.
Should IT teams be worried?
Yes, for a specific reason. Standard security tools are built to spot unusual human behaviour: someone logging in from a new country, an account active at 3 a.m. An agent logging in at 3 a.m. To process invoices looks perfectly normal. It probably is. But if the agent's key was stolen, or if it holds broader permissions than it should, nobody notices.
Permissions matter more than most users realise. The approval screen often lists broad access: "read all mail", "send as user", "modify files". Users skim it. The agent keeps every permission it was granted, indefinitely.
We covered this risk from a different angle on 16 July 2026, when our story "Forg365: The $400-a-Month Service That Hijacks Your Work Email" showed how phishing kits exploit exactly this kind of standing account access. Most companies still have no inventory of which agents are connected, who approved them, or what they can touch.
| What to check | Where to look | What to do |
|---|---|---|
| Google account | myaccount.google.com/permissions | Remove apps you don't recognise |
| Microsoft 365 | myapps.microsoft.com | Review consented applications |
| Slack | Slack settings, "Manage apps" | Remove unused integrations |
| Salesforce | Setup, "Connected Apps OAuth Usage" | Audit active connections |
What should ordinary staff do right now?
Check what's connected to your account. Both Google and Microsoft give every user a plain list of every approved app, with a one-click revoke button. Something you don't recognise or no longer use should go.
If your employer has an IT team, flag it rather than guessing. The fix isn't to stop using AI tools but to use ones your organisation has checked, granted only the access they genuinely need.
For IT teams the near-term task is straightforward if unglamorous: build an inventory of what's already connected, restrict staff from approving high-risk permissions on their own, and set tokens to expire on a schedule rather than lasting indefinitely.
Common questions
Is this the same as a data breach?
Not automatically. The risk is that a connected agent holds broad, long-lived access that nobody's watching. That becomes a real problem if the agent's permissions are misused or its login key is stolen.
Can I still use AI tools at work?
Yes. The issue isn't AI tools themselves but handing sweeping account access to software nobody has reviewed. Tools your employer has vetted, with limited permissions, carry much lower risk.
