Toxic Combinations: When Cross-App Permissions Stack into Risk
On January 31, 2026, researchers disclosed that Moltbook, a social network built for AI agents, had left its database wide open, exposing 35,000 email addresses and 1.5 million agent API tokens across 770,000 active agents. The more worrying part sat inside the private messages. Some of those conversations held plaintext third-party credentials, including OpenAI API keys shared between agents, stored in the same unencrypted table as the tokens needed to hijack the agent itself. This is the shape of a toxic combination – a permission breakdown between two or more applications, bridged by an AI agent, integration, or OAuth grant, that no single application owner ever authorised as its own risk surface.
Toxic combinations are rarely the product of a single bad decision. They appear when an AI agent, an integration, or an MCP server bridges two or more applications through OAuth grants, API scopes, or tool-use chains, and each side of the bridge looks fine on its own because the bridge itself is what no one reviewed. The telemetry gap is widening quite fast. AI agents, MCP servers, and third-party connectors now sit across two or three adjacent apps by default, and non-human identities outnumber human ones in most SaaS environments. The Cloud Security Alliance State of SaaS Security 2025 report found that 56% of organisations are already concerned about over-privileged API access across their SaaS-to-SaaS integrations.
Conventional access review rarely catches this shape. It strains in the territory modern SaaS has opened up: non-human identities like service accounts, bots, and AI agents with no human behind them, trust relationships that form at runtime rather than at provisioning time, and OAuth and MCP bridges are wired between apps without the governance catalog knowing. Answering who holds this scope plus those two other scopes, and what can those scopes accomplish together becomes much harder once the scopes in question live on a token nobody provisioned through any identity system to begin with.
This discovery highlights a growing blind spot in enterprise security. Most SaaS access reviews still examine one application at a time, which is the blind spot attackers are learning to target. The next breach at most organisations will not announce itself with a new zero-day. It will look like an agent doing exactly what it was authorised to do, all the way through to exfiltration. Whether that gets caught at approval time or written up in a post-mortem comes down to whether anyone can see the full chain of permissions across multiple applications.
Click here for the original article.