The New Phishing Click: How OAuth Consent Bypasses MFA - The Hacker News
PushButton AI Team ·
The New Phishing Click: How OAuth Consent Bypasses MFA - The Hacker News
You finally connected an AI tool to your business systems. That felt like progress. Here's what nobody told you about the new risk that comes with it.
When you link AI tools to your email, CRM, or ca
You finally connected an AI tool to your business systems. That felt like progress. Here's what nobody told you about the new risk that comes with it.
When you link AI tools to your email, CRM, or calendar — and most of them ask you to — you're granting those tools deep access to your business data. Not a little access. Everything they need to do the job.
That access doesn't disappear when you stop using the tool. The $200/month subscription you cancelled last year? It may still have a live connection into your systems. Most business owners have no idea this is sitting there.
This isn't about being tech-stupid. The companies selling these tools don't make this easy to see. They profit from you clicking "Allow" without thinking twice.
Here's your one action this week: Google "apps connected to my Google account" or "connected apps" in Microsoft 365. You'll see a list of everything that still has access. Revoke anything you don't actively use today.
Takes fifteen minutes. No consultant needed. No system overhaul. Just a clean list of what actually has the keys to your business.
What AI tools have you connected to your business that your team quietly stopped using?
