OpenAI 'o' Always-On ChatGPT Assistant With Email Access: Defending Against AI Agent Prompt Injection and OAuth Abuse

---
title: OAuth Consent Grant With High-Risk Mail Scopes
id: 3f8a2c71-6b4d-4e9a-b1c7-2d5e9f0a8b3c
status: experimental
description: Detects user or admin consent grants to applications requesting delegated mailbox permissions, a prerequisite for AI assistants (e.g., always-on agents) accessing corporate email and a common consent-phishing indicator.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/openai-is-preparing-o-an-always-on-chatgpt-assistant-that-could-handle-email/
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1550.001
  - attack.persistence
logsource:
  product: azure
  service: auditlogs
detection:
  selection_operation:
    OperationName:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
      - 'Add delegated permission grant'
  selection_scope:
    TargetResources|contains:
      - 'Mail.Read'
      - 'Mail.ReadWrite'
      - 'Mail.Send'
      - 'MailboxSettings'
      - 'full_access_as_app'
      - 'offline_access'
  condition: selection_operation and selection_scope
falsepositives:
  - Approved enterprise applications with documented mail integration (maintain an allowlist of sanctioned app IDs)
level: high
---
title: Inbox Rule Creation Forwarding or Deleting Mail
id: 8c1d4e92-7a5f-4b3c-9d2e-6f1a0b8c5d4e
status: experimental
description: Detects creation of inbox rules that forward, redirect, or delete messages. A frequent objective of attackers and a plausible action of a prompt-injected AI email assistant acting on a compromised user's behalf.
references:
  - https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1114.003
  - attack.exfiltration
logsource:
  product: m365
  service: exchange
detection:
  selection:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  selection_action:
    Parameters|contains:
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
      - 'DeleteMessage'
  condition: selection and selection_action
falsepositives:
  - Users creating legitimate forwarding rules to personal addresses (still a policy violation in most orgs)
level: high
---
title: AI Desktop Client Execution on Managed Endpoints
id: 5e2b7d14-9c3a-4f8e-a6b1-0d4c7e2f9a1b
status: experimental
description: Detects execution of AI assistant desktop clients on managed endpoints to support shadow-AI discovery and enforce acceptable-use policy before connectors are authorized.
references:
  - https://atlas.mitre.org/techniques/AML.T0051/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ChatGPT.exe'
      - '\OpenAI.exe'
      - '\Claude.exe'
      - '\Copilot.exe'
    OriginalFileName|contains:
      - 'ChatGPT'
      - 'OpenAI'
  condition: selection
falsepositives:
  - Sanctioned AI tooling in approved business units — tune to alert only outside allowlisted OUs/devices
level: low

// Hunt 1: New OAuth consent grants with mail-capable scopes (Entra ID AuditLogs)
AuditLog
| where TimeGenerated > ago(14d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant", "Add delegated permission grant")
| mv-expand TargetResources
| mv-expand TargetResources.modifiedProperties
| where tostring(TargetResources_modifiedProperties.newValue) has_any ("Mail.Read", "Mail.ReadWrite", "Mail.Send", "MailboxSettings", "full_access_as_app")
| extend AppId = tostring(TargetResources.id)
| extend ConsentUser = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, OperationName, ConsentUser, AppId, TargetResources.displayName, CorrelationId
| order by TimeGenerated desc
;
// Hunt 2: Inbox rules forwarding externally or deleting mail (Office 365 audit)
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in ("New-InboxRule", "Set-InboxRule")
| extend Params = tostring(parse_json(Parameters))
| where Params has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo", "DeleteMessage")
| project TimeGenerated, UserId, Operation, Params, ClientIP, ClientInfoString
| order by TimeGenerated desc
;
// Hunt 3: Mail access by non-interactive / unfamiliar service principals (anomalous item access)
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("MailItemsAccessed", "Send")
| where ClientInfoString has_any ("Client=WebServices", "REST", "Graph")
| summarize AccessCount = count(), DistinctIPs = dcount(ClientIP) by UserId, ClientInfoString, ClientIP, bin(TimeGenerated, 1h)
| where AccessCount > 500
| order by AccessCount desc
;
// Hunt 4: AI assistant desktop clients in the fleet (Defender)
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName has_any ("ChatGPT", "OpenAI", "Claude") or ProcessCommandLine has_any ("chat.openai", "chatgpt")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Runs = count() by DeviceName, FileName, FolderPath, AccountName
| order by FirstSeen desc

-- Hunt: AI assistant clients and persistence artifacts on endpoints
-- Identifies installed AI desktop clients, their persistence mechanisms,
-- and outbound connections to AI provider endpoints for shadow-AI discovery.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(chatgpt|openai|claude)'
   OR CommandLine =~ '(?i)(chat\.openai|chatgpt)'

-- Enumerate Run-key persistence referencing AI clients
SELECT Name, FullPath AS Value, ModTime
FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*',
          accessor='raw_registry')
WHERE FullPath =~ '(?i)(chatgpt|openai|claude)'

-- Active connections to common AI provider infrastructure
SELECT Pid, Name, RemoteIP, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Name =~ '(?i)(chatgpt|openai|claude)'

# Audit and constrain AI assistant access to Microsoft 365 mailboxes
# Requires: Microsoft.Graph PowerShell SDK, Global Admin or Cloud App Admin
# Run Connect-MgGraph -Scopes "Application.Read.All","Policy.ReadWrite.PermissionGrant","Mail.Read"

# 1. Inventory all delegated permission grants with mail-capable scopes
$ riskyScopes = 'Mail.Read','Mail.ReadWrite','Mail.Send','MailboxSettings.ReadWrite','full_access_as_app'
Get-MgOauth2PermissionGrant -All | ForEach-Object {
    $grant = $_
    $granted = $grant.Scope -split ' '
    if ($granted | Where-Object { $riskyScopes -contains $_ }) {
        $sp = Get-MgServicePrincipal -ServicePrincipalId $grant.ClientId
        [PSCustomObject]@{
            AppName   = $sp.DisplayName
            AppId     = $sp.AppId
            ConsentType = $grant.ConsentType
            Principal = $grant.PrincipalId
            Scopes    = $grant.Scope
        }
    }
} | Format-Table -AutoSize

# 2. Disable end-user self-service consent (force admin approval workflow)
$params = @{ defaultUserRolePermissions = @{ permissionGrantPoliciesAssigned = @() } }
Update-MgPolicyAuthorizationPolicy -BodyParameter $params

# 3. Enable the Admin Consent Request workflow so requests route to reviewers
# (Configure in Entra portal: Identity > Applications > Enterprise applications >
#  Consent and permissions > Admin consent settings > Users can request admin consent = Yes)

# 4. Audit inbox rules across all mailboxes for forwarding/deletion actions
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.UserPrincipalName -ErrorAction SilentlyContinue |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage } |
    Select-Object @{n='Mailbox';e={$_.MailboxOwnerId}}, Name, ForwardTo, RedirectTo, DeleteMessage
}

# 5. Block external auto-forwarding at the transport layer (defense-in-depth)
Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off