Definition
OAuth is the standard system that lets AI tools ask for permission to access external services (email, GitHub, etc.) on a user's behalf. OAuth token hijacking occurs when a malicious component — such as a rogue AI tool integration — tricks the authentication process into handing the attacker the access token, giving them the same permissions as the legitimate AI tool for all connected services.
Why it matters
As AI platforms connect to more business services via OAuth, a single stolen token can grant an attacker access to all of them simultaneously — email, code repositories, file storage — without any visible login event. LibreChat's MCP integration was found to have exactly this flaw.