Press play to start listening
A newly identified authorization flaw in enterprise AI workflows could allow external attackers to trigger privileged actions, including accessing sensitive internal information simply by asking for it, security firm Noma Labs said in a report published Wednesday, September 9.
Dubbed Workflow Identity Hijacking, the attack exploits a gap between the identity of the person triggering an AI workflow and the identity used by the workflow to perform privileged actions.
Noma Labs describes the issue as a “silent backdoor” because an externally accessible workflow can effectively provide a route into privileged internal systems without requiring the requester to have the same permissions as the workflow itself.
The Workflow, Not the Model, Is the Problem
Unlike prompt injection, the attack does not require malicious instructions, jailbreaks, or attempts to manipulate the AI model. The risk arises when an attacker can send a request to an automated system with access to internal data. For example, a message sent to a company’s support address could be picked up by an AI workflow and turned into a request for information that the sender should never be able to access.
The workflow may have its own access to company systems through a service account or API key. If it does not check the requester’s permissions before carrying out the task, that access can effectively be used on the outsider’s behalf.
Noma Labs illustrates the risk with a scenario in which an attacker asks a company’s public support address for quarterly sales numbers contained in the Finance Director’s most recent email.
The workflow can then use its existing access to search company records and send the requested information back. Nothing in the original message has to be malicious. The security gap appears because the workflow carries out a request from someone who has no permission to access that information.
From GitLost to Google Workflows
The finding follows Noma Labs’ disclosure of GitLost. As Hackread.com reported in July, GitLost is a prompt-injection flaw involving GitHub Agentic Workflows. An attacker could open an issue in a public repository and place instructions in its body. A workflow with read access to other repositories, including private ones, could then retrieve private data and expose it through a public comment.
GitLost relied on prompt injection, while Workflow Identity Hijacking does not require the model to be tricked. Both findings highlight how untrusted input can influence workflows with access to information the requester should not have.
Noma Labs also identified the same authorization risk in Google Workflows and responsibly disclosed it to Google. According to the researchers, Google acknowledged the report and confirmed a fix, but did not disclose implementation details.
Authorization Must Sit Outside the Model
Noma Labs recommends checking permissions before an AI workflow can access sensitive information or send it to an external user. The company suggests replacing long-lived API keys with temporary tokens that have limited access.
The company also recommends adding permission checks before data is retrieved and keeping internal data systems separate from tools that communicate with external users.
AI-generated information should also be treated as untrusted when it can trigger actions that the requester would not normally be allowed to perform.
Experts’ Commentary
The following comments were shared with Hackread.com by cybersecurity experts following Noma Labs’ research on Workflow Identity Hijacking. Chandra Gnanasambandam, Chief Technology Officer at SailPoint, said the rise of AI-driven attacks is making static security controls less effective and increasing the need for real-time governance of machine identities.
“Adversaries are using AI to operate at a scale and speed that makes traditional, static defenses outdated. The window between vulnerability discovery and exploitation has shrunk from months to days, and soon, minutes.”
Jeremy London, Director of Engineering, AI & Threat Analytics, at Keeper Security, highlighted the difference between authenticating the workflow and checking whether the requester is authorized to receive the data.
“Workflow identity hijacking works because authentication and authorization operate on different questions. The agent can authenticate properly using valid credentials, follow instructions exactly, and produce an accurate output, yet still disclose data to an unauthorized person.”
