---
title: "Comment by Adarsh Kant on \"Story of Abusing a Fully Secured redirect_uri in an OAuth Flow\" | Hashnode"
description: "Excellent deep dive into OAuth redirect_uri exploitation. As someone working at the intersection of cybersecurity and AI, this kind of research is critical. The"
url: "https://hashnode.com/posts/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow/69bee7154a1e513e411cffa8/comment/69c02d99d9da55a9a5c1bd3c"
---

[Discussion](https://hashnode.com/posts/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow/69bee7154a1e513e411cffa8)

Comment [Story of Abusing a Fully Secured redirect\_uri in an OAuth Flow](https://hashnode.com/posts/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow/69bee7154a1e513e411cffa8)

[Adarsh Kant](https://hashnode.com/@adarshkant)

[Mar 22](https://hashnode.com/posts/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow/69bee7154a1e513e411cffa8/comment/69c02d99d9da55a9a5c1bd3c)

Excellent deep dive into OAuth redirect\_uri exploitation. As someone working at the intersection of cybersecurity and AI, this kind of research is critical.

The attack chain you described highlights why security can't be an afterthought — especially when we're building AI agents that interact with web applications programmatically.

At ANVE.AI, we built AnveVoice — a voice AI that takes real DOM actions on websites (clicks buttons, fills forms, navigates pages). Security architecture was priority #1 because the agent is literally interacting with authenticated sessions.

Our approach: 46 scoped MCP tools via JSON-RPC 2.0, each with strict capability boundaries. The agent can't access OAuth tokens, cookies, or auth flows — it only interacts with visible DOM elements. Sub-700ms latency, WCAG 2.1 AA compliant, MIT-0 licensed.

Great work on the writeup. This is the kind of research that makes the whole ecosystem safer.