Why OAuth-as-a-Service Emerged in Agentic AI

▶ Watch (01:20)

In 2024, the researchers found 24 of 25 integration platforms vulnerable to OAuth account takeover, including services with over 100 million active users. As agentic AI multiplied third-party developers, most lacked the expertise to handle OAuth safely. The industry answer: offload token management to a centralized token manager. Microsoft ships two. The token manager issues a connection ID instead of raw tokens, keeping OAuth off each agent.

That splits the OAuth client role between the agent and the token manager. Nothing in the OAuth standards covers how. Every platform invents its own design, and that is where the vulnerabilities live.

Connection-Based OAuth Architecture Explained

▶ Watch (12:32)

Connection-based OAuth splits the OAuth client role in two. The token manager handles the full token lifecycle. The agent never sees a token — it gets a connection ID, a primary key pointing to a managed token keyed by a tool-agent-user triple. The call flow: agent requests a new connection, token manager returns an empty slot plus an OAuth URL, user consents, Dropbox’s authorization code fills the slot, agent calls APIs by referencing the ID. One detail matters: if the user already authorized that tool, Dropbox skips the consent screen automatically.

“Remember this setting because it will be the building block of many powerful stealthy oath attacks.” — Kaixuan Luo

Session Fixation in Connection-Based OAuth

▶ Watch (19:01)

The connection architecture has a fixation problem by design. When an attacker starts OAuth, the token manager returns a URL tied to the attacker’s connection. The attacker shares it with a victim. The victim logs in and consents. The victim’s Dropbox token lands in the attacker’s connection. Five vendors were vulnerable.

The fix: verify that the user who initiated OAuth is the same user who completes it. The token manager must redirect back to the agent backend to extract the session user ID. The researchers call this the post-redirect pattern.

Open Redirect When Session Fixation Defense Is Misimplemented

▶ Watch (25:06)

The post-redirect fix for session fixation introduces a second problem. To redirect back to the agent after OAuth, the token manager reads a destination URL from the browser. That’s user-controlled input. Microsoft validated it with wildcard matching only, so an attacker could point it at any subdomain with an existing XSS flaw.

He demonstrated Microsoft Power Automate Outlook email theft (26:58) live. The attacker injected JavaScript on ideas.powerapps.com, set the post-redirect there, sent the OAuth link as phishing, and when the victim clicked, the token manager delivered the victim’s Outlook authorization code straight to the attacker’s server. Fix: pre-configure redirect URLs server-side and never accept them from the front end.

Confused Deputy Attacks: Client ID Confusion and Cross-Agent COAT

▶ Watch (29:58)

Two confused-deputy variants close the attack taxonomy. Client ID confusion: OAuth-as-a-service providers pre-register shared client IDs with tools like Dropbox or GitHub, so every agent on the platform shares the same ID. A user who authorized a trusted agent has silently pre-consented for any malicious agent on the same platform.

The cross-agent COAT attack goes further. Luo demonstrated Microsoft Copilot Studio cross-agent account takeover (34:19) live — the victim clicks one URL, the attacker logs in as the victim, and every tool behind that Copilot’s OAuth gate is exposed. Six vulnerable instances found across seven vendors.

“these back to the future attacks enable tool account takeovers as easy as a single click.” — Kaixuan Luo

Notable Quotes

Remember this setting because it will be the building block of many powerful stealthy oath attacks. Kaixuan Luo · ▶ 16:20

these back to the future attacks enable tool account takeovers as easy as a single click. Kaixuan Luo · ▶ 37:12

as an end user, you may trust your agent, but you may not be aware that there is this token manager behind the scenes, which is actually a third party that you don’t recognize Kaixuan Luo · ▶ 38:49

Key Takeaways

  • Audit every OAuth-as-a-service integration your agent uses — shared client IDs silently inherit prior user consent.
  • Implement the post-redirect pattern to bind OAuth completion to the initiating user, or attackers own the connection.
  • Token managers must strictly pre-configure redirect URLs server-side; any user-controlled redirect input is an open redirect.