Granola AI notetaker has account takeover flaw: one-click hijack

A security vulnerability affecting Granola AI, a notetaker application, has been publicly disclosed by a researcher. The flaw enables account takeover through a single click, meaning an attacker can trick a user into visiting a malicious link and gain complete control of the victim's account, including access to all stored notes and associated data. The full technical details and proof of concept have been published on the Strix security research blog. The vulnerability represents a critical risk for any user or organization storing sensitive information within Granola, as a compromised account grants an attacker unrestricted access to the account holder's entire data store within the application.

The discovery of a one-click account takeover vulnerability in Granola AI highlights the security risks present in emerging productivity and AI tools. As users increasingly adopt notetaker applications to store sensitive information—from personal notes to business intelligence—the integrity of authentication and access controls becomes critical. The simplicity of the attack vector (a single malicious link) underscores how even well-intentioned applications can contain high-severity flaws if security review is incomplete during development or scaling.