Identity-Based AI Attack Threatens Security of Enterprise Data

Researchers at Noma Labs have identified a new AI attack vector called "workflow identity hijacking" that bypasses security controls in enterprise AI pipelines. The core issue stems from a fundamental difference between AI workflows and agentic workflows – AI workflows are fixed, predefined processes, while agentic workflows are more autonomous, dynamically deciding what steps to take. Workflow identity hijacking exploits this difference by allowing threat actors to send seemingly benign requests through unauthenticated entry points, such as support emails, GitHub issues, Web forms, or shared documents.

These requests can then trigger the AI workflow to retrieve and deliver information belonging to another user, specifically a high-privilege user like a finance director. The attack isn't about tricking an AI model into doing something it wasn't supposed to, but rather about leveraging the workflow's inherent trust in AI-generated output and the lack of proper identity verification.

Unlike traditional AI security, which focuses on prompt injection attacks targeting LLMs, this new vector shifts the focus back to privilege boundaries and identity delegation. The AI workflow executes using high-privilege service accounts or developer API keys rather than enforcing the permissions of the external user, effectively acting as an unauthenticated proxy for privileged actions and silent data exfiltration.

To defend against this emerging threat, Noma Labs and security experts suggest several mitigation strategies. These include practicing identity-aware token delegation by eliminating static administrative API keys in AI workflows and enforcing user-context propagation by executing data operations using short-lived, scoped delegation tokens tied directly to the authenticated requester.

Additionally, organizations should set up "contextual authorization checkpoints" by treating all LLM-generated outputs as untrusted inputs and implementing explicit access-control evaluation steps between the LLM transformation step and any subsequent database or tool invocations. Another security measure is asymmetric output separation, structurally isolating data-retrieval capabilities from external communication channels – workflows processing sensitive internal data must not share execution paths with automated external response mechanisms.

Finally, cyber deception firm Acalvio suggests "model-aware deception" – seeding the environment with decoy assets, such as fake executive threads and honeytoken records, to catch benign-looking requests that reach for them against a boundary they shouldn't be crossing.