# OAuth Grants Are Piling Up Faster Than Security Teams Can Review Them

Employees routinely connect SaaS apps and AI tools via OAuth, creating thousands of hard-to-track access grants per company. Security researchers warn this backlog is a growing breach risk and outline how automation can help teams keep up.

## A quiet access problem is growing inside every organization
Every time someone clicks "Allow" to connect a calendar app, a note-taking tool, or an AI assistant to their work account, they create an OAuth grant: a standing permission that lets one application talk to another without the user re-entering a password each time. These grants are convenient and, individually, mostly harmless. The problem is scale. According to security researchers cited in a recent industry report, the average employee creates dozens of these connections over time, and a meaningful share of them come with access to sensitive company data. Multiply that across a workforce of hundreds or thousands of people, and an organization can end up with tens of thousands of active, data-connected access paths that almost nobody is tracking.

## Why OAuth grants are harder to manage than passwords
OAuth connections differ from traditional logins in ways that make them easy to lose track of:

- **They live outside single sign-on systems.** A grant between two apps isn't automatically visible to the identity team that manages employee logins.
- **They outlive the people who created them.** A grant often keeps working even after the employee who set it up leaves the company or has their main account disabled.
- **They go dormant but stay functional.** A connection made months ago for a one-off project can sit unused and unreviewed, yet still retain full access whenever it's triggered.
- **Reviewing them is slow work.** Manually checking a single grant to decide whether it's still needed and safe can take security staff the better part of an hour, which doesn't scale against a backlog of thousands.

## A real-world warning sign
This isn't a theoretical concern. A recent breach traced back to a compromised OAuth token belonging to a third-party AI tool that an employee had connected to their organization's cloud workspace months earlier. The connection had been forgotten, but it remained a working path into company systems — exactly the kind of overlooked grant that security teams struggle to find before an attacker does.

## Why this matters now
The rise of AI assistants and agents is accelerating the problem. Many AI tools ask users to connect them directly to email, documents, or other business systems to "personalize" their output, which means each new AI integration can mint another long-lived, data-scoped grant. Analysts tracking this trend have warned that a large share of future breaches in cloud and SaaS environments are likely to involve exactly this kind of overprivileged or forgotten access, rather than a stolen password or a software exploit[↗](/exploit).

## What organizations can do about it
Security teams don't need to ban third-party integrations outright, but they do need visibility and a faster review process. Practical steps include:

- **Inventory existing grants.** Most identity and SaaS security platforms can list which third-party apps have been granted access across the organization, often surfacing far more connections than expected.
- **Prioritize by risk, not age.** Focus first on grants with access to sensitive data, grants tied to privileged accounts, or connections to vendors with weak security track records.
- **Revoke what's no longer needed.** Dormant grants that haven't been used in months are good candidates for removal, especially if the original requester has changed roles or left.
- **Automate the triage step.** Because manual review doesn't scale, some organizations are turning to automated tools that can score grants by vendor reputation, permission scope, and data sensitivity, letting humans focus their attention on the small number of genuinely risky cases.
- **Build a lightweight approval process.** Requiring a quick check before a new high-privilege integration is approved is far cheaper than cleaning up thousands of ungoverned grants later.

## The takeaway
OAuth makes everyday work more convenient, but each approved connection is also a standing door into company data. For everyday users, the practical lesson is to think twice before granting broad access to a new app and to periodically review and remove connections that are no longer in use. For organizations, the message is that OAuth sprawl needs the same ongoing attention as any other identity and access risk — not a one-time cleanup, but a continuous process.

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/oauth-grants-pile-up-faster-than-you-can-review-them-heres-how-to-keep-up/)