New AI Workflow Identity Hijacking Threatens Enterprise Data

Researchers at Noma Labs have identified a new attack vector known as “workflow identity hijacking” that allows threat actors to bypass standard security controls and exfiltrate sensitive enterprise data.

The attack exploits an authorisation design flaw found in modern enterprise artificial intelligence (AI) pipelines. It occurs when the identity and permissions of the user triggering a workflow are decoupled from the high-privilege credentials used to execute the task.

How Workflow Hijacking Bypasses Security

In a typical attack scenario, a threat actor can send a seemingly benign request through an unauthenticated entry point, such as a public support email inbox, a web form, or a shared document. Because the AI workflow interprets the request and executes it using high-privilege service accounts or developer API keys, the system acts as an unauthenticated proxy for privileged actions.

Sasi Levi, security research lead at Noma Labs, noted that the core failure is that the system executes the request exactly as designed, even though the requester has no authority to make that specific request. For example, an attacker could email a support inbox asking about their own account while simultaneously requesting the contents of a recent internal email from a finance director. The AI workflow could then fetch the sensitive email and deliver it directly to the attacker.

Distinction from Prompt Injection

This vulnerability differs significantly from traditional prompt injection attacks. While prompt injection focuses on manipulating or “jailbreaking” large language models (LLMs) to produce unintended outputs, workflow identity hijacking is an identity and privilege issue rather than an LLM manipulation issue.

In these instances, the AI model is not being tricked into behaving incorrectly. Instead, the model performs its intended function, but the surrounding automation executes that function using the identity of a privileged user without enforcing the principle of least privilege or checking the original requester’s permissions.

Mitigation Strategies

To defend against this emerging threat, researchers suggest shifting security controls from the model layer to the application and infrastructure layers. Recommended mitigations include:

• Identity-aware token delegation: Eliminating static administrative API keys in favour of short-lived, scoped delegation tokens that are tied directly to the authenticated requester.
• Contextual authorisation checkpoints: Implementing explicit access-control evaluation steps between the LLM transformation step and any subsequent database or tool invocations.
• Asymmetric output separation: Structurally isolating data-retrieval capabilities from external communication channels to ensure that workflows processing sensitive data do not share execution paths with automated external response mechanisms.
• Model-aware deception: Seeding environments with decoy assets, such as honeytoken records or fake executive threads, to detect unauthorised requests that cross established security boundaries.