AI workflows may be creating a dangerous new authorization blind spot
Noma Labs researchers describe 'workflow identity hijacking,' letting unauthenticated users trigger privileged AI workflows that execute actions with high-privilege service accounts.
Noma Labs lead researcher Sasi Levi detailed 'workflow identity hijacking,' where benign unauthenticated inputs via support inboxes, GitHub issues, or web forms trigger enterprise AI pipelines that execute privileged actions. The workflow runs using high-privilege service accounts or developer API keys, decoupled from the requester's identity, effectively creating a confused-deputy condition. Unlike prompt injection, the model behaves correctly; the failure lies in authorization enforcement at the workflow layer, and activity blends into routine automation. Mitigations include identity-aware access at execution points and user-context propagation between AI outputs and downstream operations.
- Unauthenticated entry points like support inboxes can trigger privileged enterprise AI workflows.
- Workflows execute with service account privileges decoupled from the original requester's identity.
- Model behavior is correct; the flaw is an authorization design issue at the workflow layer.
- Detection requires correlating requester, execution identity, resources, and final action.
- Mitigations: user-context propagation and runtime access-control checks between AI outputs and actions.
- Tags
- agent-securityai-agentsauthorizationconfused-deputyidentity-and-access-managementnoma-labsworkflow-identity-hijacking
- Vendors
- Noma Labs
- Products
- Noma Labs
- Organizations
- Noma LabsGoogle Threat Intelligence Group
From the original article
4 min read at csoonline.com
A newly identified AI attack technique can let unauthenticated users trigger privileged workflows and access enterprise systems, highlighting a gap in how identity and access controls apply to AI agents, according to research from Noma Labs.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.