Recent research from Noma Security’s Noma Labs has revealed a newly discovered attack leveraging legitimate, authorized use of AI workflows to obtain sensitive data. It starts with an attacker sending an ordinary message to a public support inbox requesting outright the data they want—quarterly sales figures directly from the Finance Director’s email. Within minutes, the attacker receives the data straight to their inbox. This attack does not require a breach, jailbreak, or compromised account of any kind, instead relying on the AI workflow to carry out exactly the job it was designed to do.
Defining the Attack
This discovery exemplifies the systemic AI threat vector that Noma Labs is calling workflow identity hijacking. The root cause that enables this attack is built into the AI workflow, where the identity of the user who triggers the workflow is decoupled from the identity used to execute the action. Where an agentic workflow is designed to have the ability to dynamically make decisions taking into account factors like who is sending the message, an AI workflow carries out the same deterministic steps regardless of context.
AI workflows run on high-privilege service accounts or static developer API keys, rather than the permissions and privileges of the user making the request. This means that any unauthenticated entry point into the AI workflow—including email inboxes, GitHub issues, web forms, and shared documents—becomes a proxy for users to carry out actions with the privileges granted to the AI workflow.
What Differs from Prompt Injection
While it can result in similar consequences, this attack is differentiated from prompt injection or jailbreaking by the method used to achieve malicious ends. Prompt injection attacks manipulate how an LLM follows instructions by tweaking wording to evade safety filters and “trick” the AI into operating outside of its intended parameters. This attack, on the other hand, exploits whose authority the workflow uses.
Workflow identity hijacking works because the AI workflow places implicit trust in both the AI-generated output and the privilege boundary between the requester and the privileged workflow. Two fully identical requests, one from a CFO and the other from an anonymous external actor, are processed by the AI workflow in exactly the same way, regardless of other context. There is no malicious phrasing to be caught by safety filters to block this attack, and the security failure lives in the authorization boundary, not the prompt itself.
The Guardrail Blind Spot
This attack is possible due to a gap in security in the AI workflow. Model-layer defenses like input filters and safety training were not designed to serve as authorization checks. Even locking down the factor of who is allowed to trigger the workflow still fails to address the central question of who has the authority to influence what the workflow acts on. It is crucial for every automated task to be assessed based on its least-trusted input source rather than the intended user.
Experts emphasize that this is not an issue that can be addressed by adjusting settings in existing tools. “Workflow Identity Hijacking produces zero adversarial signal at the model layer,” says Ram Varadarajan, CEO at Acalvio, a Santa Clara, California-based leader in cyber deception technology. “The request is benign, the reasoning is sound, the tool call is exactly what the workflow was built to do. Any defense sitting at the classifier or guardrail layer is structurally blind to it by design, not by tuning failure.”
Not an Isolated Incident
This is not the first time that Noma Labs has uncovered an attack like this that manipulates AI to access sensitive information. In July 2026, the GitLost prompt injection vulnerability in GitHub’s Agentic Workflows was found to enable the exposure of private repository data through issue assignment.
Upon discovering the vector of workflow identity hijacking, Noma Labs carried out further research and found the same flaw in Google Workflows. They responsibly disclosed the vulnerability to Google, who acknowledged the report and confirmed a fix. The pattern of these flaws being found indicates a systemic, cross-platform design flaw, not a singular bug that one company can find and fix.
Closing the Gap
In order to adequately protect against the risks of flaws like this in AI workflows, it is crucial to implement measures and guardrails to address the unsecured gap. These measures include things like:
- Identity-aware token delegation, which replaces static keys with short-lived tokens that are tied to the authenticated user making the request.
- Contextual authorization checkpoints placed between LLM outputs and any downstream action.
- Asymmetric output separation, which isolates sensitive data retrieval from external-facing communication paths.
A Hugging Face-Scale Reckoning
This and similar flaws signal a clear need for an industry-wide reassessment of AI security methods. This discovery forces defenders to reframe AI security from being about model security alone to requiring deeper contextual understanding. Enterprises racing to deploy various AI workflows without reworking authorization must recognize the high stakes of systemic vulnerabilities in overprivileged AI workflows.
