Noma Labs warns of "workflow identity hijacking": unauthenticated requests can trigger privileged AI workflows without any prompt injection

Noma Labs researchers describe "workflow identity hijacking," an authorization gap in enterprise AI workflows where unauthenticated inputs (support inboxes, web forms, GitHub issues) trigger pipelines that run with high-privilege service accounts or…

Two 2026-09-10 reports (CSO Online and Cyber Security News) cover the same finding from Noma Labs, described as "workflow identity hijacking." Noma Labs lead researcher Sasi Levi (per CSO Online) detailed how benign, legitimate-looking unauthenticated inputs submitted via support inboxes, web forms, GitHub issues, or support systems can trigger enterprise AI workflows that execute privileged actions. The workflow runs using high-privilege service accounts, developer API keys, or the workflow creator's credentials, decoupled from the original requester's identity, creating a confused-deputy condition. Per Cyber Security News, attackers can cause workflows to retrieve and disclose internal data as privileged proxies, without prompt injection or model misbehavior; per CSO Online, the model behaves correctly and the failure lies in authorization enforcement at the workflow layer, with activity blending into routine automation. Cyber Security News adds that scheduled workflows remain exposed to untrusted inputs like inboxes. Proposed mitigations across both reports include propagating requester/user context through workflows, identity-aware access at execution points, short-lived scoped tokens, runtime access-control checks between AI outputs and downstream actions, treating LLM outputs as untrusted data, and separating sensitive retrieval from automated external responses.

• Technique: "workflow identity hijacking," attributed to Noma Labs researchers (lead researcher Sasi Levi named by CSO Online); both reports published 2026-09-10.
• Entry points: unauthenticated inputs via support inboxes, web forms, GitHub issues, and support systems; scheduled workflows remain exposed to untrusted inputs such as inboxes (Cyber Security News).
• Privilege mechanism: workflows execute with high-privilege service accounts, developer API keys, or the workflow creator's credentials, decoupled from the requester's identity, creating a confused-deputy condition (CSO Online).
• Impact: attackers can submit legitimate-looking requests that cause workflows to retrieve and disclose internal data (Cyber Security News); activity blends into routine automation (CSO Online).
• Not prompt injection: the model behaves correctly and requests appear benign, so model guardrails miss the issue; the flaw is authorization enforcement at the workflow layer.
• Detection: requires correlating requester, execution identity, resources, and the final action (CSO Online).
• Mitigations: identity-aware access at execution points, propagation of requester/user context between AI outputs and downstream operations, short-lived scoped tokens, runtime access-control checks before sensitive actions, treating LLM…