AI Workflows Vulnerable to ‘Identity Hijacking’ via Privileged Accounts

Researchers at Noma Labs have uncovered a security flaw termed “workflow identity hijacking,” where enterprise AI pipelines can be exploited to bypass authorisation controls. The vulnerability allows unauthenticated users to trigger privileged workflows, potentially granting them access to sensitive internal systems.

The issue arises from a design flaw in modern AI pipelines where the identity of the requester is decoupled from the identity used to execute the subsequent action. According to lead researcher Sasi Levi, many workflows carry out tasks using high-privilege service accounts or developer API keys rather than enforcing the specific permissions of the initiating user.

The ‘Confused Deputy’ Risk

Unlike traditional prompt injection attacks, this technique does not rely on manipulating the AI model’s behaviour. The model and the workflow follow their predefined instructions and execution paths correctly. The failure occurs because the system does not verify whether the original requester has the authority to trigger the resulting action.

Cybersecurity researcher and red teamer Vibhum Dubey noted that this reflects a “confused deputy” problem. If an unauthenticated input can trigger a trusted workflow that possesses its own elevated privileges, the workflow effectively acts as an unauthenticated proxy for privileged actions and data exfiltration.

The risk is particularly high when attackers use benign entry points, such as support inboxes, GitHub issues, web forms, or shared documents. Because the prompts themselves appear normal, standard guardrails and prompt-injection detectors often fail to identify the threat. The security risk lies not in the content of the prompt, but in the authorisation boundary of the workflow.

For example, a researcher illustrated a scenario where an external sender sends a request for financial data. While a Chief Financial Officer (CFO) would be entitled to such information, an external party is not. If the AI pipeline executes the request using the workflow creator’s credentials, it may provide the data to the unauthorised sender without triggering an alert.

Detection and Mitigation

Detecting these attacks is difficult because the individual events often appear legitimate. Since the actions are performed by trusted workflows using valid credentials, they can blend into routine automation. Dubey suggested that effective detection requires correlating the original requester with the downstream identity used, the resources accessed, and the final action performed.

The threat is expected to grow as enterprises move toward more autonomous, agentic workflows. As AI agents begin to plan and execute multi-step tasks across various environments, the reliance on the execution layer increases, amplifying the impact of authorisation gaps.

To mitigate these risks, Noma Labs recommends shifting security controls from the model layer to the application and infrastructure layers. Recommended defences include:

• Enforcing identity-aware access at the point where actions are executed.
• Implementing user-context propagation to ensure the requester’s permissions are respected downstream.
• Applying explicit access-control and runtime protection evaluation steps between AI-generated outputs and subsequent operations.