Workflow Identity Hijacking: Attackers Exploit AI Automation for Data Exfiltration
A new vulnerability, 'Workflow Identity Hijacking,' allows attackers to exfiltrate sensitive enterprise data by exploiting authorization gaps in AI workflows, bypassing traditional security measures.
A novel vulnerability, dubbed "Workflow Identity Hijacking," is enabling attackers to exfiltrate sensitive enterprise data by exploiting inherent authorization gaps within AI automation pipelines. Unlike traditional attacks that focus on manipulating AI models through prompt injection or jailbreaking, this method circumvents these defenses by targeting the legitimacy of the request's origin and the privileged identities AI workflows use to access internal resources.
The attack vector leverages common integrations of AI workflows with public-facing systems such as email inboxes, web forms, GitHub issues, customer support platforms, and chat applications. An attacker could, for instance, submit a seemingly innocuous request through a public support email address, asking for sensitive internal information like quarterly sales figures. If the AI workflow is designed to process incoming messages and access internal data sources using privileged service accounts or the credentials of its creator, it may comply with the request, thereby exfiltrating data without the attacker ever needing direct access or advanced model manipulation skills.
Noma Labs, which identified the vulnerability, highlights that this creates a covert data exfiltration channel. The AI model itself does not need to deviate from its intended function or bypass safeguards; instead, the automation layer executing the workflow acts with excessive privileges. This distinction is crucial: while prompt injection aims to alter the AI model's behavior, Workflow Identity Hijacking focuses on the authorization of the request itself. A legitimate user might be authorized to request sales data, but an anonymous external sender making the same request should not be, yet current AI safeguards often fail to differentiate.
Traditional AI security measures, such as input filters and model guardrails, are primarily designed to detect and prevent attempts to manipulate the AI model's output or behavior. However, they typically do not verify whether the entity initiating the request possesses the necessary permissions to access the data or perform the action. The core security flaw arises when the identity of the external requester is decoupled from the identity executing the workflow, allowing unauthenticated users to trigger actions that access sensitive data via privileged developer API keys, service accounts, or administrative integrations.
While agentic AI workflows can adaptively select tools and actions, many AI workflows are more deterministic, following a predefined process. This predictability can foster a false sense of security, leading organizations to focus on restricting tool usage while overlooking the risks associated with static automations directly linked to internal systems. Even scheduled workflows, which may only be configurable by administrators, remain susceptible if they process inputs from untrusted sources like public inboxes or ticket queues.
To mitigate Workflow Identity Hijacking, organizations must adopt a security-first approach to AI workflow design and implementation. This involves identifying the least-trusted parties influencing workflow inputs and meticulously specifying permissions at each stage of the automation pipeline. Key defenses include ensuring that the authenticated requester's identity is propagated throughout the workflow, replacing persistent administrative API keys with short-lived, scoped tokens, and enforcing granular authorization checks before any sensitive actions are executed.
Furthermore, organizations should treat all outputs from large language models as untrusted data. Any workflow step that utilizes model output for subsequent actions should be subject to separate policies and access-control checks. It is also critical to separate sensitive data retrieval processes from automated external response mechanisms. This prevents workflows capable of accessing confidential financial records or private emails from inadvertently sending such information to unauthenticated users, thereby closing the covert exfiltration path.