New AI Security Threat: Workflow Identity Hijacking Exposes Sensitive Enterprise Data
Security researchers at Noma Labs have uncovered a novel attack vector called Workflow Identity Hijacking, which allows threat actors to extract confidential enterprise data through seemingly innocuous requests via public-facing channels such as support inboxes, web forms, GitHub issues, or shared documents.
Unlike prompt injection attacks, which manipulate AI models by overriding their instructions, this technique exploits a broken authorization boundary in AI workflows. Attackers submit routine requests (e.g., asking for quarterly sales figures) that trigger automated processes designed to fetch and return the data without verifying the requester’s permissions.
How the Attack Works
AI workflows often combine automation sequences with LLM processing stages. A typical flow might:
- Receive an external request (e.g., an email).
- Use an LLM to extract intent.
- Query internal systems (e.g., a finance director’s mailbox) using persistent API keys, service accounts, or OAuth tokens tied to the workflow’s creator.
- Return the response to the requester.
The vulnerability arises when the workflow fails to propagate the original requester’s identity to downstream actions. Since the automation executes with elevated privileges, an external actor can effectively impersonate the workflow’s owner, gaining unauthorized access to sensitive data.
Why Traditional Defenses Fail
- No suspicious language: Unlike prompt injection, the attack doesn’t manipulate the LLM’s behavior it simply exploits the workflow’s design.
- Static vs. agentic workflows: While agentic AI (which dynamically selects tools) has drawn scrutiny, static automations which follow predefined steps can be equally dangerous if exposed to untrusted input.
- Misplaced trust in workflows: Security teams may overlook these risks, assuming that because the LLM behaves as intended, the process is secure.
Impact and Mitigation
The attack highlights a critical shift in AI security: automation can inadvertently grant attackers the authority of the workflow’s creator. To mitigate risks, organizations should:
- Treat LLM output as untrusted input before allowing it to trigger sensitive operations.
- Propagate requester identities using short-lived, scoped delegation tokens.
- Enforce authorization checks between LLM output and every data-access operation.
- Remove static, high-privilege API keys from workflows exposed to external input.
The discovery underscores that AI security is not just about model manipulation it’s about ensuring automation never grants unauthorized access to privileged systems.
Source: https://cyberpress.org/ai-workflow-identity-hijacking-lets-attackers-steal-sensitive-data/
Noma Labs TPRM report: https://www.rankiteo.com/company/noma-labs
"id": "nom1789028951",
"linkid": "noma-labs",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Enterprises using AI workflows'}],
'attack_vector': 'Public-facing channels (support inboxes, web forms, GitHub '
'issues, shared documents)',
'data_breach': {'data_exfiltration': 'Yes (via automated workflow responses)',
'sensitivity_of_data': 'High (e.g., quarterly sales figures, '
'internal communications)',
'type_of_data_compromised': 'Confidential enterprise data '
'(e.g., financial figures, '
'internal reports)'},
'description': 'Security researchers at Noma Labs uncovered a novel attack '
'vector called Workflow Identity Hijacking, which allows '
'threat actors to extract confidential enterprise data through '
'seemingly innocuous requests via public-facing channels such '
'as support inboxes, web forms, GitHub issues, or shared '
'documents. The attack exploits a broken authorization '
'boundary in AI workflows, where attackers submit routine '
'requests that trigger automated processes to fetch and return '
'data without verifying the requester’s permissions.',
'impact': {'data_compromised': 'Confidential enterprise data (e.g., quarterly '
'sales figures)',
'operational_impact': 'Unauthorized access to sensitive data via '
'automated workflows',
'systems_affected': 'AI workflows with persistent API keys, '
'service accounts, or OAuth tokens'},
'lessons_learned': 'AI security is not just about model manipulation but '
'ensuring automation never grants unauthorized access to '
'privileged systems. Static automations can be as '
'dangerous as agentic AI if exposed to untrusted input.',
'post_incident_analysis': {'corrective_actions': ['Implement short-lived, '
'scoped delegation tokens',
'Enforce authorization '
'checks at every '
'data-access stage',
'Remove static API keys '
'from exposed workflows'],
'root_causes': 'Broken authorization boundary in '
'AI workflows, failure to propagate '
'requester identities, use of '
'static high-privilege API keys'},
'recommendations': ['Treat LLM output as untrusted input before allowing it '
'to trigger sensitive operations',
'Propagate requester identities using short-lived, scoped '
'delegation tokens',
'Enforce authorization checks between LLM output and '
'every data-access operation',
'Remove static, high-privilege API keys from workflows '
'exposed to external input'],
'references': [{'source': 'Noma Labs'}],
'response': {'remediation_measures': ['Treat LLM output as untrusted input '
'before allowing it to trigger '
'sensitive operations',
'Propagate requester identities using '
'short-lived, scoped delegation tokens',
'Enforce authorization checks between '
'LLM output and every data-access '
'operation',
'Remove static, high-privilege API keys '
'from workflows exposed to external '
'input']},
'title': 'Workflow Identity Hijacking Exposes Sensitive Enterprise Data',
'type': 'Data Breach / Unauthorized Access',
'vulnerability_exploited': 'Broken authorization boundary in AI workflows, '
'failure to propagate requester identities to '
'downstream actions'}