3 ms·

I'm not super savvy with OAuth, but shouldn't scopes prevent issues like this? https://oauth.net/2/scope/ https://oauth.net/2/scope/

• highphive 6mo ago
  They can mitigate it, if the user refuses to oauth into something that asks for too much scope. Most users just click "accept" (this claim based on no data at all).
  • Maxious 6mo ago
    > at least one Vercel employee signed up for the AI Office Suite using their Vercel enterprise account and granted “Allow All” permissions. Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace. https://context.ai/security-update https://context.ai/security-update
    • steve1977 6mo ago
      So it's not so much a problem with OAuth itself, but with the way it was implemented here?
• tgv 6mo ago
  From what I understood at [1], Context.ai users "enable AI agents to perform actions across their external applications, facilitated via another 3rd-party service." I.e., it's designed to get someone's OAuth token and use it. Unless that is done really carefully, the risks are as high as the user's authorization goes. The danger doesn't only come from leaks, but also from agents, that can clear your db or directory at a whim. [1] https://context.ai/security-update https://context.ai/security-update
  • steve1977 6mo ago
    Oof. So much incompetence at so many levels. It's scary.