Workflow Identity Hijacking: New AI Attack Vector Exploits Authorization Flaws
Researchers have identified a novel attack technique, 'workflow identity hijacking,' that exploits design flaws in enterprise AI pipelines to bypass security controls and access sensitive data.
Security researchers at Noma Labs have unveiled a new attack methodology dubbed "workflow identity hijacking," which targets a fundamental authorization flaw within modern enterprise AI pipelines. This technique allows threat actors to circumvent traditional security measures by submitting seemingly innocuous requests through unauthenticated entry points, such as support inboxes, GitHub issues, or web forms. The core of the vulnerability lies in the decoupling of the user's identity and permissions from the identity and permissions used to execute the AI workflow itself.
According to Noma Labs' report, the attack vector exploits the inherent trust AI workflows place in their own generated outputs and the privilege boundary between the user initiating a request and the system executing it. In a typical scenario, an AI workflow might execute actions using high-privilege service accounts or developer API keys, rather than enforcing the permissions of the external user making the request. This effectively turns AI workflows into unauthenticated proxies capable of performing privileged actions and exfiltrating data silently.
Researchers illustrated this with a scenario where an attacker sends an email to a company's support inbox, posing a question about their account while also inquiring about the content of the finance director's latest email. The AI workflow, upon processing this request, retrieves and sends the finance director's email contents back to the attacker, demonstrating a clear breach of confidentiality and access control.
The distinction between AI workflows and agentic workflows is crucial to understanding this vulnerability. While AI workflows follow a predefined sequence of steps with an LLM performing a specific task, agentic workflows are more autonomous, with the AI dynamically deciding its path and tools. Workflow identity hijacking specifically targets the former, leveraging the trust in AI-generated output and the privilege separation.
This attack vector represents a departure from more commonly discussed AI security threats like prompt injection. Instead of tricking or manipulating the AI model itself, workflow identity hijacking focuses on identity and authorization issues. As described by Morey Haber, chief security adviser at BeyondTrust, the AI model performs exactly as instructed, but the workflow around it uses an untrusted identity, highlighting a failure in scoping and least privilege.
Mitigating workflow identity hijacking requires a shift in security focus from the AI model layer to the application and infrastructure layers. Noma Labs recommends implementing identity-aware token delegation, which involves eliminating static administrative API keys and enforcing user-context propagation through short-lived, scoped delegation tokens tied to the authenticated requester. This ensures that actions are performed with the appropriate, limited privileges.
Furthermore, organizations should establish "contextual authorization checkpoints." This involves treating all LLM-generated outputs as untrusted inputs and implementing explicit access-control evaluations before any subsequent database or tool invocations. Asymmetric output separation is also advised, structurally isolating data retrieval capabilities from external communication channels to prevent sensitive data from being processed by automated external response mechanisms.
Security experts also suggest employing "model-aware deception" techniques, such as seeding the environment with decoy assets like fake executive threads or honeytoken records. Benign-looking requests that attempt to access these decoys can signal that a workflow is crossing unauthorized boundaries, providing an early warning for security teams.