Shadow AI in SaaS: How Hidden AI Agents Are Enabling Catastrophic Breaches

Shadow AI Is Inside Every Organization — And Attackers Know It

A new report from Grip Security, analyzing 23,000 SaaS application environments, has delivered a blunt finding: 100% of analyzed companies are operating SaaS environments with embedded AI that their security teams cannot fully see or control. With a 490% year-over-year spike in public SaaS attacks and a defining 2025 breach that cascaded through 700+ organizations simultaneously, the era of shadow AI as a theoretical risk is over — it is now the defining breach vector of 2026.

The Scale of the Problem

The Grip Security "2026 SaaS + AI Data Report: From Chaos to Control" makes clear that shadow AI is not primarily about employees sneaking ChatGPT past IT. It is about AI agents baked directly into business-critical SaaS platforms — CRM systems, HR tools, sales automation, communication platforms — by vendors, often without customers' full awareness. These agents operate with pre-approved OAuth tokens connecting them to downstream enterprise systems, and they create an attack surface that traditional security models were never designed to address.

Why SaaS AI Creates Cascading Breaches

The OAuth Token Problem

The core vulnerability is straightforward and devastating. Here is how a shadow AI breach cascades:

1. SaaS vendor embeds an AI agent into their product
2. Enterprise customer grants OAuth tokens to connect SaaS app
   to downstream systems (Salesforce, Slack, Google Workspace, etc.)
3. Attacker compromises the SaaS vendor's environment
4. Attacker steals pre-approved OAuth/refresh tokens
5. Using valid, trusted tokens, attacker impersonates the SaaS app
   → logs directly into customer's downstream systems
   → bypasses MFA entirely (the token is already authenticated)
6. Breach cascades to EVERY customer of the compromised vendor

As Chad Holmes (Grip Security): "Identity is the new perimeter. If we have that identity [the OAuth token], we can log into any environment anywhere."

Idan Fast, CTO of Grip Security, framed the structural problem: "AI did not introduce intelligence into your organization. Rather, it introduced the ability for software to read data and take action inside business systems at a speed that traditional governance models were never designed to handle."

The old security assumption — that at least one side of every transaction was under your control — breaks entirely when two external systems (an AI platform and a SaaS application) connect directly without a security checkpoint between them.

The Defining Breach: Salesloft-Drift (August 2025)

The most consequential shadow AI breach of 2025 — tracked as UNC6395 (also known as GRUB1) — demonstrates exactly how this attack pattern plays out at scale.

What Happened

Drift, a chatbot SaaS product acquired by Salesloft, was integrated with Salesforce, Slack, and Google Workspace across hundreds of enterprise customers. In August 2025, threat actors:

1. Compromised Drift's internal systems via GitHub repository access
2. Moved laterally into Drift's AWS environment
3. Stole active OAuth and refresh tokens that enterprise customers had granted to connect Drift to their business applications
4. Used those legitimate, pre-approved tokens to impersonate Drift and log directly into customers' Salesforce installations — bypassing MFA entirely
5. Over a 10-day window, systematically queried and exfiltrated large volumes of records from 700+ organizations

Data Exposed

• Business contact records (names, titles, emails, phone numbers)
• Salesforce objects: Accounts, Contacts, Opportunities, Cases
• In many cases: API keys, Snowflake tokens, cloud credentials, and passwords embedded in support cases

Affected Organizations (700+ total)

Among the named victims: Cloudflare, Google, Palo Alto Networks, Zscaler, CyberArk, PagerDuty, Proofpoint, SpyCloud, Tanium — and hundreds more.

The breach was contained on August 20, 2025, when Salesloft and Salesforce jointly revoked all Drift OAuth tokens. By then, the damage was done across hundreds of organizations that had trusted a single SaaS AI integration.

Emerging Agentic AI Attack Vectors

Beyond OAuth token theft, the report identifies a broader set of attack surfaces introduced by agentic AI in SaaS environments:

Recommendations

Governance

• Replace static approvals with continuous oversight, discovery, and risk-based controls
• Treat AI-enabled SaaS as monitored critical third-party risk — apply the same rigor as you would to any critical supplier
• Ask the foundational governance question: "Who or what can act on our systems through AI today?"
• Establish recurring governance reviews of high-privilege OAuth scopes
• Update incident response playbooks to include AI-related breach scenarios

Visibility and Discovery

1. Inventory all AI tools — both known and unknown — via CASB and SaaS management platforms
2. Monitor network traffic for connections to generative AI API endpoints
3. Audit all OAuth tokens and API keys for unauthorized AI integrations
4. Map OAuth connections to actual identities and permission levels — not just vendor lists
5. Deploy endpoint DLP to detect sensitive data flows to AI tools

Access Controls

• Enforce least privilege for all AI agents and SaaS integrations
• Actively scan and remove embedded secrets (API keys, passwords) from SaaS environments
• Implement continuous OAuth token monitoring with automatic revocation triggers
• Integrate AI activity logs into SIEM systems for anomaly detection

Vendor Management

• Require SaaS vendors to disclose all embedded AI capabilities before and after onboarding
• Mandate data processing agreements that explicitly cover AI agent data access
• Include breach notification SLAs that account for AI-mediated access paths

Tools and Frameworks

Key Takeaways

1. Shadow AI is universal — 100% of analyzed organizations operate AI-enabled SaaS environments with insufficient visibility or control, averaging 140 AI-enabled SaaS environments per organization.
2. The Salesloft-Drift breach (UNC6395) is the defining example: one SaaS AI vendor compromise cascaded into 700+ organizations via pre-approved OAuth tokens — bypassing MFA entirely.
3. OAuth tokens are the new keys to the kingdom — pre-approved tokens eliminate MFA as a defense once a SaaS vendor is compromised.
4. 3 million AI agents now operate inside corporations, with fewer than half actively monitored — the attack surface is expanding faster than governance models can adapt.
5. Shadow AI-related breaches cost an average of $670,000 more than non-AI breaches, and represent 20% of all data breach incidents (IBM).
6. With 40% of enterprise apps projected to embed AI agents by end of 2026, the organizations that establish AI-aware identity governance now will be significantly better positioned than those that wait.

Sources

• Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches — SecurityWeek
• The Salesloft-Drift Breach: Analyzing the Biggest SaaS Breach of 2025 — Reco.ai
• BREAKING: UNC6395 — The Biggest SaaS Breach of 2025 — Obsidian Security
• Widespread Data Theft Targets Salesforce via Salesloft Drift — Google Cloud Threat Intelligence
• 2026 SaaS + AI Data Report: From Chaos to Control — Grip Security
• State of AI Agent Security 2026 — Gravitee
• Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026