Every AI tool, workflow automation, and productivity app your employees connected to Google or Microsoft this year left something behind: a persistent OAuth token with no expiration date, no automatic cleanup, and in most organizations, no one watching it. Your perimeter controls don't see it. Your MFA doesn't stop it.
The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed
Summary + source link. No paywalls, no tracking.