Noma Labs Uncovers 'Workflow Identity Hijacking' in Enterprise AI Pipelines
A critical authorization flaw allows attackers to use high-privilege service accounts as proxies to exfiltrate sensitive data.
Security researchers at Noma Labs have identified a new attack vector termed "workflow identity hijacking" that enables attackers to bypass enterprise security controls. By sending benign-looking requests through unauthenticated entry points, such as web forms or support emails, attackers can trigger AI workflows to exfiltrate sensitive corporate data.
The vulnerability exists because of a decoupling between the identity of the person triggering a workflow and the permissions used to execute it. In many enterprise setups, AI workflows—which are fixed, predefined processes—operate using high-privilege service accounts or static developer API keys. When an untrusted user triggers one of these processes, the system executes the request using these administrative permissions rather than the requester's own limited access.
As Morey Haber, chief security adviser at BeyondTrust, noted, the attack does not rely on tricking the AI. "Nobody tricked an AI model into anything it was not supposed to do," Haber said. "The model did exactly what it was told, by a stranger (untrusted), and the workflow around it used someone else's identity to make that happen."
The Architecture of the Flaw
This vulnerability is fundamentally an identity and authorization design flaw rather than a failure of the Large Language Model (LLM) itself. Unlike prompt injection or jailbreaking, which attempt to manipulate the model's output or bypass its safety filters, workflow identity hijacking exploits the infrastructure surrounding the AI.
In a typical scenario, an organization might implement an AI-driven support system to handle customer queries. If that system is configured to use a high-privilege service account to fetch data from internal databases without propagating the original user's identity, it creates a proxy. Sasi Levi, security research lead at Noma, emphasized that the failure is structural: "The core failure is that the requester had no authority to make that request."
Implications for AI Security
This discovery signals a significant shift in the enterprise AI attack surface. For months, security teams have focused heavily on the model layer—fighting prompt injection and ensuring output alignment. However, the Noma Labs research demonstrates that these defenses are insufficient if the application and infrastructure layers are poorly configured.
When security controls are absent at the identity delegation level, the AI becomes a powerful tool for unauthorized data access. The ability to trigger high-privilege actions via unauthenticated channels means that traditional perimeter defenses are bypassed, as the request appears to be a legitimate internal process once it reaches the execution stage.
Moving Toward Least Privilege
To mitigate this risk, organizations must move their security focus from the model layer to the infrastructure layer. The primary defense is the implementation of the principle of least privilege, ensuring that AI workflows do not operate with blanket administrative access.
Security architects are now being urged to implement strict identity propagation, where the permissions of the end-user are carried through the entire workflow. Until enterprises transition away from static, high-privilege service accounts in their AI pipelines, they remain vulnerable to attackers who can simply ask the system for data it was never intended to share with the public.