Before Connecting AI to Google Drive, Inbox, or Slack: A 10-Question Check

Between August 8 and August 18, 2025, threat group UNC6395 used stolen OAuth access and refresh tokens from the Salesloft Drift AI chat integration to pull records from more than 700 organizations (Google Threat Intelligence Group, August 2025; Help Net Security, September 2, 2025). Without cracking a single employee password or triggering a multi-factor authentication prompt, attackers queried connected Salesforce tables and integrated Google Workspace email accounts, searching support cases for AWS keys, Snowflake tokens, and plaintext credentials. Perimeter login defenses stayed quiet because users and admins had already clicked "Allow" months earlier, handing a connected app persistent offline access.

Measured breach telemetry puts third-party connectors at the center of workplace AI incidents. In IBM's 2026 Cost of a Data Breach Report (n = 602 breached organizations studied globally), compromised APIs, apps, and plug-ins ranked as the top initial cause of breaches targeting AI models and applications, accounting for 27% of AI breaches in that 2026 study (IBM Newsroom, July 29, 2026). Across the same n = 602 organizations, unapproved AI tools appeared in 43% of security incidents, and AI-enabled malicious breaches averaged $6.0 million per organization.

Acceptable-use policies routinely tell employees what not to paste into an AI tool at work, yet skip the "Connect Google Drive" or "Add to Slack" button right beside the prompt bar. Pasting leaks one paragraph; clicking "Allow" on a broad OAuth screen opens five years of shared folders and inbox threads. This operational guide provides general security information, not legal advice, and equips teams with The ed.cafe 10-Question OAuth Connector Gate & 5-Minute Token Revocation Guide.

What actually happens behind the "Allow" button when you connect an AI app?

Clicking "Allow" on an OAuth 2.0 consent screen issues a cryptographic bearer token that lets an external AI vendor's servers query your cloud files, emails, or chats directly over API without needing your password. Two lines on that popup decide your blast radius: the scope and offline refresh rights.

Compare the three scope tiers employees encounter when connecting ChatGPT, Claude, Gemini, Microsoft 365 Copilot, or third-party AI meeting and inbox assistants:

1. Per-file picker scope (drive.file in Google): The AI app can only read the specific single document you manually select inside a picker window. Your remaining 15,000 Drive files stay invisible to the token.
2. Account-wide read scopes (drive.readonly, gmail.readonly, Files.Read.All, Mail.Read, Slack channels:history + groups:history): The connector can index and search 100% of the folders, historic email attachments, and private Slack channels your identity can view, including an old HR compensation sheet shared with you in 2022.
3. Write, send, delete, and offline_access scopes (drive, gmail.modify, Mail.ReadWrite, Mail.Send, Slack chat:write): The app can overwrite spreadsheets, send emails from your real address, delete messages, and hold a persistent refresh token (offline_access) that keeps working at 3:00 AM even after you log out or change your SSO password.

Granting full-drive (drive or Files.ReadWrite.All) plus offline_access just to summarize one quarterly PDF works like handing an outside courier a duplicate brass master key to every filing cabinet in your building because you wanted help carrying one folder to the copier. Changing the front-door code next month does nothing; that duplicate cabinet key still opens every drawer until a locksmith re-pins the locks. Where the brass-key analogy breaks down is speed: a courier still walks cabinet-by-cabinet past cameras, whereas a stolen OAuth refresh token scrapes 40,000 cloud files and inbox secrets over HTTPS API calls in ninety seconds from overseas.

First-party commercial plans (ChatGPT Team/Enterprise, Claude for Work, Google Workspace with Gemini, Microsoft 365 Copilot) contractually block training on commercial workspace data, unlike personal consumer accounts compared in our guide on personal vs work AI account tiers. Yet zero-training contracts do not stop two technical failures: vendor token theft (like Salesloft Drift) and cross-context prompt injection.

How can an outside email or public Slack message steal files through an approved AI connector?

Even when an AI vendor is trustworthy and unbreached, connecting one AI assistant simultaneously to untrusted inbound messages and private internal storage creates a cross-context exfiltration bridge. Hostile text arriving from an outsider can command your AI connector to search private files you never meant to touch.

Three documented disclosures from August 2024 through August 2025 show this mechanism across Slack, Microsoft 365, and Google Drive connectors:

Notice why EchoLeak (CVE-2025-32711) hit over-shared tenants hardest: an AI connector sees everything your login token can read, including forgotten "Everyone in Org" folders. Before turning on tenant-wide search, run the cleanup steps in our Microsoft 365 Copilot permissions cleanup guide for small tenants and pair local developer extensions with our 12-point MCP server, skill, and plugin install check.

What are the 10 questions to check before clicking "Allow" on any AI connector?

In the ed.cafe 10-Question OAuth Connector Gate developed at No Worker Left Behind, employees and team leads score ten plain-English checks in under three minutes before approving any Drive, inbox, calendar, or Slack integration. Any "No" on Questions 1 through 5 stops the connection immediately:

1. Commercial zero-training contract: Are you signed into a company-managed business or enterprise AI workspace (never a free or personal $20/month login) with zero model training on customer data?
2. Publisher verification: Does the OAuth screen show a Google/Microsoft "Verified" publisher badge matching the exact domain of an approved vendor?
3. File-picker vs full-drive scope: Can you upload the single file manually or grant per-file drive.file access instead of handing over drive.readonly or Files.Read.All across every historic folder?
4. Zero unneeded write/send/delete rights: Does the prompt ask only for readonly scopes rather than Mail.Send, gmail.modify, Files.ReadWrite.All, or Slack chat:write? (Align write rights with our AI agent permission ladder.)
5. No regulated red-zone folders in reach: Does your account lack unsegmented read access to HIPAA charts, 42 CFR Part 2 records, payroll SSNs, M&A folders, or .env keys without a signed BAA/DPA?
6. Offline refresh justification: Does the tool actually require 24/7 background polling (offline_access), or can you use a session-only connector?
7. Cross-context prompt isolation: Will this session stay separate from untrusted external emails, web pages, or shared vendor docs while holding Drive or Slack search access?
8. Standard login vs admin account: Are you connecting from a standard user account rather than a Super Admin or Global Admin login?
9. Vendor token vault & breach SLA: Does the vendor hold a SOC 2 Type II report, encrypt stored OAuth tokens in KMS/vault hardware, and commit to 24-to-72 hour breach notice?
10. Named owner & 90-day sunset: Have you logged the app with a human owner and a 90-day calendar reminder to revoke unused tokens?

Worked example: pruning zombie OAuth tokens across a 30-person agency in 40 minutes

Run the numbers with stated assumptions for a 30-person marketing, accounting, or consulting firm auditing third-party OAuth connectors for the first time:

• Typical baseline sprawl (stated assumption for a 30-seat tenant after 2 years without API blocking): Average 4.5 user-consented third-party apps per worker = 135 active OAuth token grants, of which roughly 60% of grants (81 tokens across the 30-user sample) belong to abandoned trials, old AI meeting bots, or unused extensions.
• Audit and revocation labor:
• IT admin exports third-party OAuth grants in Google Admin Console (API controls) or Entra ID (Enterprise applications), sorts by scope (Mail.ReadWrite, drive, offline_access), and blocks unapproved apps while switching default policy to "Allow only admin-approved apps": 25 minutes at $72/hour loaded = $30.00.
• Each of the 30 employees spends 3 minutes opening myaccount.google.com/connections or myapps.microsoft.com during a Friday standup to delete stale personal grants: 90 staff-minutes at $46/hour average loaded wage = $69.00.
• Total quarterly cleanup cost: $99.00 in combined wages (under $400 per year).
• Risk reduction: Cuts active third-party OAuth attack surface from 135 persistent refresh tokens down to 3 or 4 vetted commercial tools, blocking supply-chain token sweeps before a breached trial vendor exposes client files.

Exact 5-minute revocation paths for Google Workspace, Microsoft 365, and Slack

Bookmark this reference table so any worker or IT lead can kill an AI connector token without hunting through documentation menus:

Copy-ready artifact: The ed.cafe 10-Question OAuth Connector Gate & 5-Minute Token Revocation Guide

Copy The ed.cafe 10-Question OAuth Connector Gate & 5-Minute Token Revocation Guide into your company Notion, Confluence, or onboarding handbook:

POLICY ID: ED-GATE-30     OWNER: IT / Operations Lead     REVIEW: Every 90 Days

PART A: 10-QUESTION PRE-CONNECTION CHECK (STOP ON ANY "NO" IN #1 TO #5)
App Name & Domain: _______________________  Requester: _____________  Date: ________

[ ] 1. Commercial Tier: Signed into a paid Business/Enterprise zero-training account?
[ ] 2. Verified Publisher: Consent screen shows verified domain badge (not a clone)?
[ ] 3. Narrowest File Scope: Can single-file upload or drive.file replace full Drive read?
[ ] 4. Read-Only Default: Zero write/send/delete scopes (no Mail.Send, gmail.modify,
       Files.ReadWrite.All, or chat:write) unless explicitly approved by IT?
[ ] 5. Regulated Data Clear: Account lacks access to unsegmented HIPAA/Part 2, SSN/payroll,
       M&A folders, or raw .env keys (OR signed BAA/DPA is on file)?
[ ] 6. Offline Token Check: Is 24/7 offline_access truly needed over session-only use?
[ ] 7. Untrusted Input Wall: Will this connector stay separate from external emails,
       public web forms, and untrusted vendor docs that carry prompt injections?
[ ] 8. Non-Admin Identity: Connecting from a standard user login (NEVER Global/Super Admin)?
[ ] 9. Vendor Vault Posture: SOC 2 Type II + encrypted token storage + <=72h breach SLA?
[ ] 10. Sunset Logged: Recorded in App Inventory with a 90-day token review date?

PART B: 5-MINUTE EMERGENCY TOKEN REVOCATION RUNBOOK (IF A VENDOR IS BREACHED)
Minute 0-2 (Block Org-Wide App):
- Google Admin: admin.google.com > Security > Access and data control > API controls >
  Manage Third-Party App Access > Select App > Change access to BLOCKED.
- Microsoft Entra: entra.microsoft.com > Enterprise applications > [App] > Properties >
  Enabled for users to sign-in = NO; Permissions > Revoke admin/user consent.
- Slack Admin: [workspace].slack.com/apps/manage > [App] > Configuration > Remove App.

Minute 2-4 (Kill Active Refresh Sessions & Audit Self-Grants):
- Individuals revoke immediately at:
  * Google: https://myaccount.google.com/connections
  * M365 Work: https://myapps.microsoft.com  | Personal: account.microsoft.com/privacy/app-access
  * Slack: https://[workspace].slack.com/apps/manage
- Admins trigger "Sign out / Revoke sessions" on all users who held tokens for the app.

Minute 4-5 (Rotate Exposed Secrets & Check Forwarding Rules):
- Search Drive/SharePoint/Slack items readable by affected users for API keys, .env files,
  Snowflake/AWS credentials, or client tokens and rotate them immediately.
- Inspect Gmail/Outlook settings on affected mailboxes for rogue auto-forwarding rules.

APPROVED BY: ___________________________   NEXT 90-DAY AUDIT: _____________________

Where this stops being true

Auditing OAuth screens and revoking stale refresh tokens blocks the primary connector breach paths, but four technical realities require deeper controls:

• Revoking a token stops future API pulls, not already-copied files: If an attacker or shady wrapper scraped your Drive folder on Tuesday, clicking "Remove Access" on Thursday cuts live access, yet any API keys, passwords, or client tokens inside read files must still be rotated manually.
• Domain-wide delegation bypasses user OAuth screens: In Google Workspace (Domain-wide Delegation via GCP service accounts) and Microsoft Graph (Application permissions), super-admins can grant silent background read access that never shows on myaccount.google.com/connections. Audit service-account grants separately.
• Browser extensions read rendered DOM pixels without OAuth: An AI Chrome sidebar granted "Read and change all your data on all websites" reads open Gmail, Slack, and bank tabs directly inside the browser without appearing in OAuth logs. Lock extension installs via Chrome Enterprise or Intune alongside API controls.
• General operational guidance, not legal advice: HIPAA covered entities, SEC/FINRA financial firms, and public agencies face statutory vendor-contracting rules beyond OAuth settings. Review regulated cloud integrations with privacy and compliance counsel.

Questions people ask

Key terms

• OAuth 2.0 scope: The exact API actions (read, write, send, delete) an app asks permission to perform on your cloud account without your password.
• Offline refresh token (offline_access): A long-lived token letting an external server pull fresh access tokens in the background while you are offline.
• Cross-context prompt injection: Hidden instructions inside an untrusted email, chat channel, or external doc that hijack a connected AI tool into leaking private files.
• Admin consent workflow: A setting in Google Workspace or Microsoft Entra ID blocking unverified third-party OAuth apps until IT reviews their scopes.
• Service principal: The directory identity created inside Microsoft Entra ID when an external SaaS or AI app receives tenant permissions.
• Least-privilege file picker (drive.file): A narrow OAuth scope granting an app access to one chosen file at a time rather than your full cloud drive.

Sources

1. Google Cloud Threat Intelligence Group (GTIG), "Data Theft from Salesforce Instances via Salesloft Drift OAuth Tokens" (August 2025): Google GTIG Advisory.
2. Help Net Security, "Zscaler, Palo Alto Networks, SpyCloud among the affected by Salesloft breach" (Over 700 organizations impacted, September 2, 2025): Help Net Security Report.
3. IBM Newsroom, "IBM Study: One in Four Malicious Breaches Are AI-Enabled, Costing Companies $6 Million on Average" (n = 602 breached organizations; compromised APIs/plugins 27% of AI breaches, July 29, 2026): IBM 2026 Breach Study Release.
4. PromptArmor, "Data Exfiltration from Slack AI via Indirect Prompt Injection" (August 20, 2024): PromptArmor Technical Disclosure.
5. The Hacker News, reporting on Aim Security disclosure of CVE-2025-32711 ("EchoLeak"), "Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction" (June 2025): The Hacker News Report.
6. CSO Online, "Black Hat researchers demonstrate zero-click prompt injection attacks in popular AI agents" (August 2025): CSO Online Coverage.