Executive Summary
Security researchers at Noma Labs have identified a new AI attack vector called 'workflow identity hijacking' that exploits authorization design flaws in enterprise AI pipelines. The attack allows threat actors to bypass standard security controls by sending seemingly benign requests through unauthenticated entry points like support emails or web forms. The AI workflow processes these requests using high-privilege service accounts, enabling unauthorized data access and exfiltration without traditional prompt injection techniques. This represents a fundamental shift from model manipulation to identity delegation vulnerabilities in AI systems.
This attack vector is particularly relevant now as organizations rapidly deploy AI automation without proper identity scoping and least privilege principles, creating widespread exposure to data breaches through seemingly legitimate AI interactions.
Why This Matters Now
Organizations are rapidly implementing AI workflows without proper identity boundaries, creating a new class of privilege escalation vulnerabilities that bypass traditional AI security controls focused on prompt injection.
Attack Path Analysis
Attackers exploit workflow identity hijacking by sending seemingly benign requests through unauthenticated entry points like support emails or web forms. The AI workflow processes these requests using high-privilege service accounts, bypassing normal authorization controls. Threat actors can access sensitive data across cloud environments by manipulating AI pipelines that decouple user identity from execution permissions. The attack leverages legitimate AI automation to exfiltrate confidential information without triggering traditional security controls.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker sends crafted request through unauthenticated entry point (support email, GitHub issue, web form) targeting AI workflow automation
MITRE ATT&CK® Techniques
Valid Accounts
Access Token Manipulation
Impair Defenses: Disable or Modify Tools
Account Discovery
Data from Local System
Exfiltration Over C2 Channel
Phishing: Spearphishing Attachment
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User Identity Verification
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Access Control Policy and Procedures
Control ID: ZT.AC-1
NIS2 Directive – Risk Analysis and Information System Security Policies
Control ID: Article 21.2(a)
ISO 27001 – Access to Networks and Network Services
Control ID: A.9.1.2
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
AI workflow identity hijacking enables unauthorized access to sensitive financial data through automated systems, bypassing standard security controls and exposing customer information.
Information Technology/IT
Enterprise AI pipelines with authorization design flaws allow attackers to exploit workflow identity decoupling, compromising privileged service accounts and API keys.
Health Care / Life Sciences
HIPAA-regulated organizations face data exfiltration risks through unauthenticated AI workflow entry points, enabling silent access to protected health information.
Government Administration
Public-facing AI workflows create attack vectors for unauthorized data access through support channels, potentially compromising sensitive government communications and operations.
Sources
- Identity-Based AI Attack Threatens Security of Enterprise Datahttps://www.darkreading.com/threat-intelligence/identity-based-ai-attack-security-enterprise-dataVerified
- NIST AI Risk Management Framework (AI RMF 1.0)https://www.nist.gov/itl/ai-risk-management-frameworkVerified
- OWASP Top 10 for Large Language Model Applicationshttps://owasp.org/www-project-top-10-for-large-language-model-applications/Verified
- CISA Roadmap for Artificial Intelligencehttps://www.cisa.gov/sites/default/files/publications/CISA_Roadmap_for_AI_508c.pdfVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain this AI workflow identity hijacking by segmenting access between external entry points and high-privilege service accounts. Multi-stage segmentation controls could reduce the blast radius of compromised AI automation systems accessing sensitive enterprise data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network segmentation may have limited direct connectivity between external-facing application entry points and internal AI workflow processing systems, reducing immediate access pathways
Control: Zero Trust Segmentation
Mitigation: Identity-aware segmentation would likely constrain service account access scope, limiting which internal systems and databases the compromised AI workflow could reach with elevated privileges
Control: East-West Traffic Security
Mitigation: Microsegmentation enforcement may have blocked unauthorized lateral movement between AI workflow systems and sensitive database resources, constraining cross-system access attempts
Control: Multicloud Visibility & Control
Mitigation: Enhanced visibility into cross-cloud communications would likely detect anomalous AI workflow behavior patterns, constraining sustained command and control channel establishment
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies may have blocked or restricted large-scale data transfers from AI systems to external destinations, limiting exfiltration of sensitive enterprise information
The overall data breach scope would likely be reduced through limited lateral movement and constrained egress, though some sensitive information exposure may still occur within segmented boundaries
Impact at a Glance
Affected Business Functions
- Data Security and Privacy
- Customer Support Operations
- Enterprise AI/ML Workflows
- Internal Communications
Estimated downtime: N/A
Estimated loss: N/A
Potential unauthorized access to sensitive enterprise data including executive communications, financial information, and customer data through AI workflow exploitation. Risk of privilege escalation and data exfiltration via unauthenticated entry points.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with identity-based policies to prevent AI workflows from accessing resources beyond their intended scope using least privilege principles
- • Deploy Egress Security & Policy Enforcement to control and monitor outbound AI workflow communications, preventing unauthorized data exfiltration through automated response channels
- • Establish Multicloud Visibility & Control to monitor AI workflow activities across hybrid environments and detect anomalous interactions or suspicious automation patterns
- • Configure Cloud Native Security Fabric (CNSF) controls to provide real-time inspection of AI agent activities and enforce contextual authorization checkpoints between AI processing and data access
- • Implement identity-aware token delegation by eliminating static administrative API keys in AI workflows and enforcing user-context propagation through short-lived, scoped delegation tokens
