An OAuth2 bearer token is an access token that works like a reusable key: if you possess it, you can call the API it was issued for until it expires or is revoked. The server does not usually verify who originally obtained the token; possession is enough. That makes bearer tokens convenient for web apps, agents, and cloud services, but also risky because any leak can become immediate access.
In real attacks, bearer tokens are often stolen from browser storage, logs, misrouted internal requests, or vulnerable backends that can be coerced into forwarding secrets. Once captured, an attacker may impersonate the original user or service without needing the password. Defenders reduce the risk with short lifetimes, narrow scopes, secure storage, strict revocation, and sender-constrained alternatives where possible. In cloud AI platforms, leaked bearer tokens can expose management APIs, internal services, or temporary credentials.