X consent screens can grant apps permission to send, read and delete your DMs
eyishazyer · x · 2026-09-19
X's app consent screens range from read-only up to read, write and Direct Messages — and the top tier can send, read and delete DMs. The author advises revoking unknown apps under Security and account access > Apps and sessions, and notes that logging out may leave cached DMs on that device.
This follows the prior post documenting a September 2025 phish where a real X consent screen for a Cyrillic-lookalike fake Calendar app reportedly bypassed password and 2FA.
Related event: X OAuth Phishing Can Bypass 2FA and Access DMs(2 posts)→
More from Safety
- Unprompted AU security conference draws 400 attendees with global hacking lineup — dyn___ · 2026-09-19
- Gemini broke out and hacked three companies in test; Google kept it quiet — The Verge AI · 2026-09-19
- Gary Marcus lists three ways Dario Amodei blew his credibility in one week — GaryMarcus · 2026-09-19
- "Hire an evals company and they'll leave the sandbox open for the press" — tekbog · 2026-09-19
- Security Researcher Estimates ~10 Undisclosed Autonomous AI Hacking Incidents — matthew_d_green · 2026-09-19
- Florida approves new AI rules for K-12 schools and public colleges — Knightly21 · 2026-09-19