New AI Workflow Identity Hijacking Attack Lets Hackers Exfiltrate Sensitive Data

Security researchers have recently disclosed a new enterprise AI attack technique known as Workflow Identity Hijacking. This method enables external attackers to exfiltrate sensitive corporate information by submitting seemingly harmless requests to AI-powered automations.

Research published by Noma Labs researcher Sasi Levi reveals that this attack does not rely on prompt injection, stolen credentials, or jailbreaking an AI model.

Instead, it exploits a fundamental authorization flaw: AI workflows can process untrusted input from low-privileged or anonymous users while executing subsequent actions with the workflow creator’s elevated permissions.

For example, an attacker might send a benign-looking request to a public company support email address, asking for quarterly sales figures from a finance executive’s latest email.

If an AI workflow monitors that inbox, searches internal emails, and responds automatically, the attacker may receive the requested data even without access to the company’s email environment.

AI Workflow Identity Hijacking Attack

The issue arises when a workflow’s trigger identity is disconnected from the identity used to execute follow-up actions.

Many enterprise automations utilize high-privilege service accounts, OAuth tokens, or developer API keys to access internal applications such as email, cloud storage, source code repositories, CRM systems, and ticketing platforms.

An AI model may interpret an inbound email, GitHub issue, web form, shared document, or chat message, then pass an instruction or structured output to later stages of a deterministic workflow. Those later stages often run with the workflow owner’s permissions.

“The core failure is that the requester had no authority to make that request,” Levi noted. “The enterprise AI pipeline reads the input, interprets the request, and executes the action as designed.”

This scenario effectively turns an AI workflow into an unauthenticated proxy for privileged actions. The model does not need to be tricked; it can accurately understand the request and follow its programmed workflow without issue.

Noma Labs distinguishes Workflow Identity Hijacking from both direct and indirect prompt injection attacks:

Attack type	What attackers exploit	Typical technique
Direct prompt injection	Model instructions	Adversarial prompts intended to override system rules
Indirect prompt injection	Data processed by the model	Malicious instructions embedded in webpages, emails, PDFs, or documents
Workflow Identity Hijacking	Authorization boundary	A legitimate-looking request that causes privileged workflow execution

In a prompt injection attack, adversaries aim to alter model behavior. In Workflow Identity Hijacking, however, the model’s behavior remains unchanged. The weakness lies in the workflow’s failure to validate whether the individual influencing an action has the authority to request it.

For instance, both a CFO and an external attacker could ask the identical question: “What are the quarterly sales numbers from the Finance Director’s most recent email?” Since the request itself contains no malicious language, traditional prompt-injection filters and LLM guardrails may treat both messages similarly. However, only one of these requesters should be authorized to access that information.

The research highlights risks beyond autonomous AI agents. AI workflows are often static, predefined pipelines where an LLM performs an initial processing stage before the automation takes deterministic downstream actions. In contrast, agentic systems dynamically determine tools, steps, and actions based on a goal.

Security programs have increasingly focused on limiting agent tool access and monitoring autonomous decision-making. However, these protections may not adequately address static workflows, particularly when an LLM’s output influences downstream actions performed by a privileged account.

Noma Labs warns that organizations must carefully examine the least-trusted entity that can influence an automation. This may include anonymous email senders, public GitHub issue authors, web form submitters, external collaborators, chat participants, and users who can modify shared documents.

The researchers linked this issue to a previous study known as “GitLost,” concerning GitHub Agentic Workflows. In that case, a workflow processed assigned issues and had broad repository-read permissions, potentially allowing external issue activity to affect access to private repository data.

Noma Labs also identified and responsibly disclosed a similar Workflow Identity Hijacking risk in Google Workflows. Google acknowledged the report and confirmed it implemented a fix, although it has not made the technical details public.

Organizations should treat inbound AI workflow content as untrusted and enforce authorization at every downstream action. Recommended safeguards include per-user identity propagation, least-privilege service accounts, explicit authorization checks before data retrieval or sharing, restrictions on public triggers, and detailed audit logging that records all activities.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.