OAuth Token Abuse - Literal OAuth Token in Agent Subprocess Egress

This detects an AI agent running a command-line tool like curl or wget where the command itself contains a real, working OAuth or API token instead of a variable reference. That means the token has already been exposed somewhere and is now being sent out over the network in plain text, which lets whoever intercepts or logs it reuse it to act as the agent or its user.

How the attack works

An OAuth token (Google, GitHub, Slack, a Bearer JWT, or a similarly shaped access/refresh token) ends up hard-coded into a command the agent runs, rather than being pulled in via an environment variable or a credential-fetch call. The agent then spawns curl, wget, httpie, or a PowerShell equivalent to reach an external http(s) address, with that literal token embedded in the command line. This is the last visible step of a token-theft chain: the token was already pulled from context, logs, or storage before this point, and this event is it being replayed against a real API.

Why it matters

A leaked token used this way lets an attacker impersonate the agent or the user it acts for against the external service, with whatever access that token grants - potentially reading or modifying data in Google, GitHub, Slack, or any Bearer-token-protected API.

What you can do

Audit how the agent's shell or subprocess tool sources credentials; require indirect references (env vars, vaults, provider CLIs) and forbid literal secrets in command strings.
Review any command-line history or execution logs for tokens appearing in plaintext, and rotate any token found exposed this way immediately.
Restrict or log outbound network calls made by agent subprocesses so unexpected destinations for token-bearing requests are visible.
Treat matches as needing manual triage: distinguish legitimate token-refresh calls (e.g. refresh_token to a provider's own token endpoint) from an agent leaking a live token to an arbitrary external host.

Known benign look-alikes

An engineer debugging a live API through the agent's shell tool who pastes a real short-lived access token directly into a curl command instead of using an environment variable.
Helper or bootstrap scripts that resolve a secret from a vault into a shell variable and then echo/expand it inline before invoking curl, so the expanded literal appears on the child process command line.
Legitimate OAuth refresh or token-exchange flows executed with curl against a provider token endpoint, where refresh_token=<value> is genuinely present in the POST body.
Slack / GitHub App installation or troubleshooting runbooks that include a real bot or installation token in the documented command.
Authorised red-team, secret-scanning validation, or credential-rotation drills that intentionally transmit a live token.