New AI Security Threat: Workflow Identity Hijacking Exposes Sensitive Enterprise Data Security researchers at Noma Labs have uncovered a novel attack vector called Workflow Identity Hijacking, which allows threat actors to extract confidential enterprise data through seemingly innocuous requests via public-facing channels such as support inboxes, web forms, GitHub issues, or shared documents. Unlike prompt injection attacks, which manipulate AI models by overriding their instructions, this technique exploits a broken authorization boundary in AI workflows. Attackers submit routine requests (e.g., asking for quarterly sales figures) that trigger automated processes designed to fetch and return the data without verifying the requester’s permissions. ### How the Attack Works AI workflows often combine automation sequences with LLM processing stages. A typical flow might: 1. Receive an external request (e.g., an email). 2. Use an LLM to extract intent. 3. Query internal systems (e.g., a finance director’s mailbox) using persistent API keys, service accounts, or OAuth tokens tied to the workflow’s creator. 4. Return the response to the requester. The vulnerability arises when the workflow fails to propagate the original requester’s identity to downstream actions. Since the automation executes with elevated privileges, an external actor can effectively impersonate the workflow’s owner, gaining unauthorized access to sensitive data. ### Why Traditional Defenses Fail - No suspicious language: Unlike prompt injection, the attack doesn’t manipulate the LLM’s behavior it simply exploits the workflow’s design. - Static vs. agentic workflows: While agentic AI (which dynamically selects tools) has drawn scrutiny, static automations which follow predefined steps can be equally dangerous if exposed to untrusted input. - Misplaced trust in workflows: Security teams may overlook these risks, assuming that because the LLM behaves as intended, the process is secure. ### Impact and Mitigation The attack highlights a critical shift in AI security: automation can inadvertently grant attackers the authority of the workflow’s creator. To mitigate risks, organizations should: - Treat LLM output as untrusted input before allowing it to trigger sensitive operations. - Propagate requester identities using short-lived, scoped delegation tokens. - Enforce authorization checks between LLM output and every data-access operation. - Remove static, high-privilege API keys from workflows exposed to external input. The discovery underscores that AI security is not just about model manipulation it’s about ensuring automation never grants unauthorized access to privileged systems.