standard
Delegated authorization standard whose grants and tokens the article identifies as the new entry point into workspace data for both attackers and AI agents.
No evidence-backed relationships are recorded.
Scope customization makes optional permissions deselectable at authorization time. It is opt-in, but once you opt in, the token you get may be smaller than the token you asked for.
Reality
Anthropic's Workspace connectors ask before each send, trash or delete by default. On Team and Enterprise plans, owners choose whether members can waive that prompt.
Reality
A dev.to benchmark ran one agent against the hosted Appwrite and Vercel MCP servers on the same six-stage job. The most useful finding was a tool that succeeded and reported otherwise.
Reality
A Material Security executive argues the Vercel and Composio breaches were one attack run twice, entered through a token rather than an inbox. The same pattern describes sanctioned AI agents.
Reality