An extension, a refresh token, a listing
April 2026: Context.ai, an AI browser extension, is compromised. Refresh tokens sitting on its backend get stolen. One of them belongs to a Vercel employee whose Google Workspace scopes were far broader than "summarize my inbox" needed. Attackers replay the token. They read internal mail, Drive, and password-reset threads. They did not phish a password. They did not beat MFA. Public reporting put a dark-web listing around two million dollars. Whether that price is exact is less important than the mechanic. Blast radius was the consent screen from months earlier, not a VPC diagram.
This write-up is reconstructed from public reporting and from how Google OAuth actually works. ScopeMantle was not claimed as a deployed control in Vercel's tenant. When I say "a ScopeMantle-equipped org would have seen," I mean the signals the product emits on that grant shape, not a fictional war story.
Pair this with Salesloft Drift and the supply-chain playbook. Same TTP. Different storefront.
Approximate timeline
About 90 days out. An engineer installs Context.ai from the Chrome Web Store. Consent lists gmail.readonly, drive.file, and userinfo.email. Allow. No ticket. Extensions sit outside the Salesforce-and-Slack procurement path.
About 60 days out. Vendor ships a team workspace. Tokens live in multi-tenant cloud the customer never assessed. No PO, so no vendor-risk file.
About 45 days out. Industry install counts rise. Orgs that already inventory OAuth see a wave of unattested AI grants, many with Scope Sanity below 40 on the scoring rubric.
About 14 days out. The Vercel-shaped grant is: new vendor, Scope Sanity in the high twenties (we use 28 as the worked example for mail plus Drive on an AI assistant), no public SOC 2 on file, owner in platform engineering. An attestation nudge would have fired. Without inventory, the row sits in Google Admin under Apps with access, next to forty other unreviewed apps.
About 3 days out. Public accounts describe token storage reached via a CI secret failure, same class as Drift's GitHub path in 2024. Google's token endpoint sees refreshes from Context.ai IP space. That looks healthy.
T0. Attackers filter tokens by email domain. A vercel.com grant exposes RFCs, customer contracts in Drive, reset threads in Gmail. The SOC on the network edge sees nothing useful. Calls originate from the vendor, not the laptop.
Plus 6 hours. External tip about a listing. IR disables the employee account. That does not revoke the third-party refresh token. The grant lives until someone finds the client ID in Admin or runs an emergency connected-app audit.
Plus 18 hours. Google OAuth revocation for the Context.ai client ID. Vendor notice. Drift comparisons within hours. The ugly question: why was the grant still there ninety days after install?
Plus 7 days. AI-tool policies get rewritten. Continuous inventory is still the control most teams skip.
Mechanics
Refresh tokens are bearer credentials. Hold the string, mint new access tokens, until revoke or client-secret rotation. Extensions and widgets store tokens server-side so the product works when the browser is closed. Trust moves from the user session to the vendor's vault. That is the boundary attackers now buy or break.
gmail.readonly is bodies and metadata, not "just headers" in the way people hope. drive.file is files the user opened through the extension, which in an engineering week is everything that mattered. Combined, the attacker skips phishing kits, MFA prompts, and VPN tickets.
CASBs see the first consent hop if the device is proxied. They do not see vendor-to-Google refresh. SIEM use cases are built for humans. DLP on the laptop never sees cloud-to-cloud reads. Identity inventory from Google Workspace and Okta is the control that lists the grant before the vault is stolen.
After access, mail points at Notion, Figma, staging URLs. Drive holds keys in README drafts. Lateral movement is informational. You do not need to escalate in Vercel's cloud IAM. Google APIs are good at bulk export. One vault is every customer who clicked Allow. Per-employee IR does not scale. Client-ID revoke does.
Signals a ScopeMantle tenant emits on this shape
- New vendor, empty dossier, queued in governance.
- Scope Sanity below 40 (worked example: 28).
- HRIS title in platform engineering raises severity.
- Ninety days without attestation lands on the weekly digest and the board export.
- Breach-feed match: bulk revoke of that client ID on Google and Okta. Entra follows when that connector is GA.
- Optional event stream for SIEM: install, score change, attestation, revoke.
- Privacy: DSAR outreach with operator-reviewed templates, parallel clock.
What you can do this week without us
- Google Admin: Security, Access and data control, API controls, Manage third-party app access. Filter AI and unknown publishers. Record client IDs.
- Chrome enterprise: extension allow-list in a sandbox OU first. Context.ai-class tools lived in the store before they lived in Admin.
- Write the IR line: "Disable user is not revoke. Revoke the client ID." Put it in the book before Friday.
- Auto-block mail-plus-Drive on unknown vendors if you can stomach the tickets. Offer a 48-hour attestation fast track so people do not flee to personal Gmail.
- Tabletop a 16:00 Friday disclose. Measure hours to workforce-wide revoke. Under four hours is a reasonable target once you have inventory. Without it, you will miss Monday.
Policy lessons
Treat extensions as SaaS. A refresh token against corporate identity is a vendor, invoice or not. Block consumer AI at Chrome policy, then offer an approved narrow-scope alternative with a signed attestation.
Auto-revoke below 40 is aggressive and often right for engineering orgs that install weekly. Pair it with a fast track. IR playbooks must lead with OAuth revocation. Board reporting should show unreviewed grant exposure, not only CVEs. Use the board template.
What to tell an auditor or a customer
"We inventory Google and Okta OAuth grants. AI extensions with mail and Drive require attestation or they are revoked. Here is the client-ID revoke log from the last tabletop." Do not claim we were in Vercel's environment. Do not claim HIPAA. Entra is labelled Beta on integrations. No fabricated customer counts on customers.
Extension governance that survives a sprint retro
Engineers install tools because a demo was funny and the ticket queue is slow. You will not lecture that out of existence. You will do three unsexy things: allow-list in Chrome, a 48-hour review SLA, and a weekly digest that names the new client IDs. If the digest is empty for a month, your export is broken or your allow-list is working. Check which.
Publish an internal wiki that maps Google scope URLs to a blast-radius tier. Example: https://www.googleapis.com/auth/gmail.readonly is Tier 1 mail content. drive.metadata.readonly is not harmless; file names carry customer identity. People who grant it thinking "read-only metadata" need that sentence in writing.
Reports API activity logs show authorize events. They do not replace a cumulative grant inventory. Auditors want state, not a trail of consents you might have missed when the script 429'd. Admin console remains the manual source until a connector with backoff is in place. ScopeMantle's Google connector is built for that sync. Your bash job from 2023 is not.
What to do after you finish this page
- Export Admin apps. Revoke one extension you cannot defend.
- Turn on extension allow-list in one OU.
- Read Drift, Snowflake, CC9.2.
- Start a 30-day trial if you want daily diff. $5 annual / $6 monthly, no seat min, custom 500+.
What to tell customers if you are the vendor in this story
This page is written for the customer CISO. If you build an extension that stores Google refresh tokens, your job is the inverse: minimize scopes, isolate tenants, rotate, and publish a revoke story customers can execute in Admin without calling you. Do not tell them "disable the user." Tell them the client ID. Publish it in the incident notice. Drift-era notices that said "review connected apps" without IDs cost days.
If you are Vercel-the-customer in a tabletop, your comms line is: token replay via a third-party grant, employee account disable was not sufficient, client-ID revoke completed at time T, scope of data is mail and Drive for principals X. You do not need a two-million-dollar figure in the customer email. That number was press. Your customers care whether their data was in those threads.
Sandbox OU before company-wide block
First time you block an AI category at the OU, do it in a sandbox. Measure ticket volume for a week. Then expand. Change management is not optional because OAuth feels virtual. People will escalate to the CEO about a summarizer. You want a paper trail that you piloted, communicated, and offered an approved alternative. That trail also satisfies the "we are not chaotic" part of CC9.2 monitoring. Reports API authorize events are not cumulative grant state. Admin console (or a connector with backoff) remains the source of truth when a script 429s on Friday night.
Field guide: the Friday after an AI-vendor disclosure
Find the client ID in Admin, not the brand string only. Revoke workforce-wide. Export before and after. Tell IR that user disable is already done or not, and that it was never sufficient. Privacy starts the DSAR fork with operator templates and counsel. Comms avoids the two-million-dollar figure unless press already owns it. Customers care whether their data was in the threads.
We were not in Vercel's tenant. Signals above are the grant shape, not a fictional deployment diary. $5 / $6, no seat min, Entra Beta, HIPAA not attested. Trial.
Pilot the OU block. Offer a 48-hour attestation fast track. Publish the client ID in any vendor notice you write if you are on the vendor side of this story. Disable-user remains insufficient. We were not deployed at Vercel. The grant shape still maps.
If you only remember one operational sentence: disable-user does not revoke the extension's refresh token. Client-ID revoke does. Chrome allow-list is upstream. We described signals for that grant shape. We did not claim a seat in Vercel's SOC.
Add gmail.readonly to the internal scope wiki as Tier 1 mail content the same week you read this. File-name metadata is not harmless. Authorize-event logs are not cumulative state. Admin or a connector with backoff remains the source of truth.
Tabletop the 16:00 Friday disclose before you need it. Measure hours to workforce revoke. Under four hours is a reasonable target once inventory exists. Without inventory you will miss Monday. That drill is also CC9.2 monitoring evidence.
Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.