A New AI Attack Vector Exposes Enterprise Data to Threat Actors
In a disturbing development that highlights a critical flaw in modern enterprise artificial intelligence (AI) pipelines, security researchers have identified a new type of attack flow that can bypass standard security controls and hijack an organization’s data. Dubbed “workflow identity hijacking,” this attack vector allows threat actors to exploit a design weakness in AI authorization systems, essentially turning them into unauthenticated proxies for privileged actions.
The issue arises from the way these AI pipelines decouple the identity and permission of the user who triggers the workflow from the permissions used to execute it. As explained by Sasi Levi, security research lead at Noma Labs, “the enterprise AI pipeline reads the input, interprets the request, and executes the action exactly as designed.” However, this process leaves a critical vulnerability open to exploitation: if an attacker can manipulate the input, they can trick the system into granting them access to sensitive information without being detected.
This attack vector is particularly concerning because it requires minimal effort on the part of the threat actor. By sending a seemingly innocuous request through an unauthenticated entry point – such as a support email or shared document – attackers can bypass traditional security controls and gain unauthorized access to high-privilege service accounts or developer API keys. As Levi notes, “minutes later, the contents of the Finance Director’s most recent email arrive in the attacker’s inbox.” This is not an issue of AI manipulation; rather, it is a problem of identity delegation.
The researchers at Noma Labs emphasize that this attack flow is distinct from traditional prompt-injection attacks, which manipulate or trick large language models (LLMs). Workflow identity hijacking is an identify issue, where attackers exploit the trust in AI-generated output and the privilege boundary between users and system administrators. This new vector shifts the focus back to privilege boundaries and identity delegation – areas that have been largely overlooked in traditional AI security frameworks.
The implications of this discovery are far-reaching. As Morey Haber, chief security adviser at BeyondTrust, warns, “the model did exactly what it was told, by a stranger (untrusted), and the workflow around it used someone else’s identity to make that happen since it was not scoped and treated with least privilege.” This highlights a critical need for organizations to reassess their AI pipeline design and implement robust security measures to prevent such attacks. Ultimately, this discovery serves as a stark reminder of the importance of prioritizing identity delegation and privilege management in AI-powered systems.
For businesses, the takeaway from this research is clear: it’s no longer sufficient to rely solely on traditional security controls to protect against AI-related threats. Organizations must take proactive steps to address authorization weaknesses in their AI pipelines, ensuring that access controls are properly scoped and treated with least privilege. By doing so, they can mitigate the risk of workflow identity hijacking attacks and safeguard sensitive data from unauthorized access.
Source: Dark Reading — 2026-09-09