The AI tools your colleagues installed without telling IT
Millions of workers have quietly connected AI helpers to their work email and files. Most companies have no idea what is running, or what it can do.
Key points
- AI agents, software that takes actions on your behalf rather than just answering questions, are spreading inside company systems without IT approval.
- Most connect through OAuth, the standard "Allow this app" permission screen, which can hand an agent long-term access to email, calendars and files in two clicks.
- A refresh token, a long-lived digital key created during that approval, lets an agent keep logging in for weeks or months without asking again.
- The majority of companies have no central list of which agents are active, who approved them, or what permissions they hold.
- Both Google and Microsoft give every user a page where they can see and remove connected apps right now.
Somewhere in your company, someone clicked "Allow" on an AI tool last week. They meant well. They found something that drafts their emails or schedules their meetings, signed in with their work account, and got back to their day. What they probably did not read was the permissions screen that quietly handed that tool access to their inbox, their calendar and their shared drive.
As first reported by ThreatVectr, this is now a pattern across companies of every size, playing out inside Google Workspace, Microsoft 365, Slack and Salesforce.
What exactly is an AI agent, and why does it need your password?
An AI agent is not a chatbot. A chatbot answers questions. An agent acts: it books meetings, files expenses, drafts and sends replies, moves files between apps. To do any of that, it needs to log in as you, or alongside you.
The login happens through something called OAuth, the mechanism behind every "Sign in with Google" button you have ever clicked. The technical spec is called RFC 6749, but you already know how it feels: a screen pops up listing what the app wants access to, you click approve, and that is that.
The catch is what gets created in the background: a refresh token. Think of it as a spare key. The agent holds it and uses it to keep logging back in, automatically, for weeks or months, without you seeing another prompt. Multifactor authentication, the six-digit code your employer probably makes you use, does not help here. You already passed that check when you clicked approve. The agent's key works without you.
Should IT teams be worried?
Yes, for a specific reason. Standard security tools are built to spot unusual human behaviour: someone logging in from a new country, an account active at 3 a.m. An agent logging in at 3 a.m. to process invoices looks perfectly normal to those tools. It probably is normal. But if the agent's key was stolen, or if it holds broader permissions than it should, nobody notices.
The permissions question matters a lot. The approval screen often lists broad access: "read all mail", "send as user", "modify files". Users skim it. The agent keeps every permission it was granted, indefinitely.
Most companies currently have no inventory of which agents are connected, who approved them, or what they can touch.
| What to check | Where to look | What to do |
|---|---|---|
| Google account | myaccount.google.com/permissions | Remove apps you do not recognise |
| Microsoft 365 | myapps.microsoft.com | Review consented applications |
| Slack | Slack settings, "Manage apps" | Remove unused integrations |
| Salesforce | Setup, "Connected Apps OAuth Usage" | Audit active connections |
What should ordinary staff do right now?
Check what is connected to your account. Both Google and Microsoft give every user a plain list of every app approved to access their account, with a one-click revoke button. If you see something you do not recognise or no longer use, remove it.
If your employer has an IT team, flag it to them rather than guessing. The fix is not to stop using AI tools. It is to use ones your organisation has checked and approved, granted only the access they genuinely need.
For IT teams the near-term task is straightforward if unglamorous: build an inventory of what is already connected, turn off the ability for staff to approve high-risk permissions on their own, and set tokens to expire on a schedule rather than lasting indefinitely.
Common questions
Is this the same as a data breach?
Not automatically. The risk is that a connected agent holds broad, long-lived access that nobody is watching. That becomes a real problem if the agent's permissions are misused or its login key is stolen.
Can I still use AI tools at work?
Yes. The issue is not AI tools themselves but handing sweeping account access to software nobody has reviewed. Tools your employer has vetted and approved, with limited permissions, carry much lower risk.
