We have all been there- quickly clicking the “Accept” option on a long list of permissions to get a new app running or new software installed. However, new research from the firm Red Canary suggests this common habit can be a goldmine for hackers.<\/p>\n
By examining how a legitimate app like ChatGPT<\/a> connects to corporate accounts, researchers found that its permission request process can sometimes be used by hackers to sneak into a person’s private inbox.<\/p>\n Researchers didn’t just guess how this happens; they tracked a specific scenario on 2 December 2025. An employee at a firm called Contoso Corp, identified as The app, which has a specific App ID of For your information, this is done through a verification system called OAuth<\/a>. It is the technology that lets you “Sign in with Google or Apple” on different websites without sharing your password.<\/p>\n In this instance, though, the user granted permissions via a service called Microsoft Graph<\/a>. The key permission granted here was Most of us rely on security codes or multi-factor authentication to keep our accounts safe. But here is the catch: once a user gives non-admin consent to an app, those extra security layers are often bypassed as the app creates a Service Principal, which is a digital representative that stays logged in using a token.<\/p>\n According to<\/a> researchers, this creates a quiet route into cloud email<\/a>. Because the app stays logged in using this digital token, it can keep reading data in the background without ever asking for a password or security code again.<\/p>\nThe Contoso Case Study<\/strong><\/h3>\n
[email protected]<\/a><\/code>, linked the ChatGPT app to their work account.<\/p>\ne0476654-c1d5-430b-ab80-70cbd947616a<\/code>, was granted access within the company\u2019s Entra ID<\/a> environment, known as Tenant ID 747930ee-9a33-43c0-9d5d-470b3fb855e7<\/code>.<\/p>\nMail.Read<\/code>. According to researchers, this simple click meant the app had “access to read the emails” of the user. Because the request came from the IP address 3.89.177.26, it looked like a standard setup and didn’t trigger any immediate alarms.<\/p>\nThe Invisible Security Gap<\/strong><\/h3>\n