A New AI Attack Vector Threatens Enterprise Data Security, Highlighting Authorization Flaws in Modern AI Pipelines
Security researchers have identified a sophisticated artificial intelligence (AI) attack flow that can bypass standard security controls and hijack an organization’s sensitive data. Dubbed “workflow identity hijacking” by Noma Labs, the attackers exploit an authorization design flaw in modern enterprise AI pipelines to gain unauthorized access to valuable information.
The researchers discovered that this new attack vector allows threat actors to send seemingly innocuous requests through unauthenticated entry points, such as support inboxes or GitHub issues. These requests are then interpreted and executed by the AI pipeline, which reads the input, performs the requested action, and delivers the results without verifying the identity of the user who triggered the workflow.
This is made possible because modern AI pipelines decouple the identity and permission of the user from the permissions used to execute the actions. As a result, even if an attacker has no authority to make a request, they can still manipulate the system by sending a crafted message that tricks the AI into performing unauthorized actions.
To illustrate this vulnerability, Noma Labs described an attack scenario in which an attacker sends a query about their own account, along with a question about what the finance director said in her last email. Within minutes, the contents of the finance director’s most recent email are delivered to the attacker’s inbox, demonstrating how easily sensitive information can be extracted.
The researchers attribute this flaw to the distinction between AI workflows and agentic workflows. While AI workflows follow a fixed, predictable sequence of steps, agentic workflows are more autonomous and allow the AI agent to decide dynamically what steps to take. Workflow identity hijacking is an attack vector that exploits the trust inherent in AI-generated output and the privilege boundary between users.
This new threat differs from traditional prompt-injection attacks, which manipulate or trick large language models (LLMs). Instead, workflow identity hijacking is an identity issue that puts a spotlight on authorization flaws in modern AI pipelines. “Nobody tricked an AI model into anything it was not supposed to do,” says Morey Haber, chief security adviser at BeyondTrust. “The model did exactly what it was told, by a stranger (untrusted), and the workflow around it used someone else’s identity to make that happen since it was not scoped and treated with least privilege.”
As organizations continue to automate processes using AI, this attack vector highlights the importance of securing privilege boundaries and identity delegation. Traditional AI security frameworks focus on treating agents and models as the primary attack surface, but this new threat shifts the focus back to authorization and identity management.
For organizations relying on AI automation, it’s essential to recognize that modern AI pipelines can be exploited through seemingly innocuous entry points. To mitigate this risk, businesses should implement robust authentication controls, limit privileges to only those necessary for each workflow, and regularly review and update their AI security frameworks to address emerging threats like workflow identity hijacking.
Ultimately, the discovery of this new attack vector serves as a reminder that security is an ongoing process that requires continuous vigilance and adaptation in response to evolving threats. By staying informed about emerging risks and best practices, organizations can stay ahead of attackers and protect their sensitive data from unauthorized access.
Source: Dark Reading — 2026-09-09