{"id":9411,"date":"2026-09-10T12:04:44","date_gmt":"2026-09-10T12:04:44","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9411"},"modified":"2026-09-10T12:04:44","modified_gmt":"2026-09-10T12:04:44","slug":"ai-workflows-may-be-creating-a-dangerous-new-authorization-blind-spot","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9411","title":{"rendered":"AI workflows may be creating a dangerous new authorization blind spot"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A newly identified AI attack technique can let unauthenticated users trigger privileged workflows and access enterprise systems, highlighting a gap in how identity and access controls apply to AI agents, according to research from Noma Labs.<\/p>\n

The report<\/a>, authored by Noma Labs lead researcher Sasi Levi, describes the issue as \u201cworkflow identity hijacking,\u201d where attackers bypass standard controls by sending normal, benign requests through an unauthenticated entry point such as a support inbox, GitHub issue, web form, or shared document.<\/p>\n

\u201cThe enterprise AI pipeline reads the input, interprets the request, and executes the action exactly as designed,\u201d Levi wrote in the report. \u201cThe core failure is that the requester had no authority to make that request.\u201d<\/p>\n

Authorization breaks at the workflow layer<\/h2>\n

At the center of the issue is what Levi describes as \u201can authorization design flaw in modern enterprise AI pipelines,\u201d where the identity of the requester and the identity used to execute actions diverge.<\/p>\n

\u201cThe identity and permissions of the user who triggers a workflow are decoupled from the identity and permissions used to execute it,\u201d he wrote. In practice, that means workflows carry out actions \u201cusing high-privilege service accounts or developer API keys\u201d instead of enforcing the initiating user\u2019s access rights.<\/p>\n

As a result, AI workflows can act as \u201cunauthenticated proxies for privileged actions and silent data exfiltration,\u201d the report added.<\/p>\n

Vibhum Dubey, a cybersecurity researcher and red teamer, said the issue reflects a known class of authorization weakness.<\/p>\n

\u201cIf an unauthenticated input can trigger a trusted workflow, and that workflow performs actions using its own privileges, the workflow can effectively act as a confused deputy.\u201d<\/p>\n

He added that in many deployments, \u201cthe original requester\u2019s permissions are not necessarily re-evaluated when the workflow performs sensitive actions downstream.\u201d<\/p>\n

Same request, different authority<\/h2>\n

The report illustrates the risk with a scenario involving identical requests from different actors.<\/p>\n

\u201cConsider two identical inputs,\u201d Levi wrote, including a query for financial data from a senior executive\u2019s email. \u201cThe prompt and requested operation are identical, but the authorization decision should be completely different.\u201d<\/p>\n

\u201cA CFO is entitled to that information; an external sender is not.\u201d<\/p>\n

Because the input itself is benign, \u201cstandard prompt-injection detectors and agent guardrails classify these inputs identically,\u201d he noted. \u201cThe security risk isn\u2019t in the prompt; it is in the authorization boundary.\u201d<\/p>\n

The model behaves correctly, but the system does not<\/h2>\n

Unlike prompt injection attacks, this technique does not rely on manipulating the model\u2019s behavior, according to the report.<\/p>\n

\u201cThe attacker does not need to manipulate the model at all,\u201d Levi wrote. \u201cThe model follows its instructions correctly, and the workflow follows its predefined execution path correctly.\u201d<\/p>\n

The failure occurs when the workflow executes the resulting action \u201cusing the workflow creator\u2019s identity or privileges without verifying whether the original requester was authorized.\u201d<\/p>\n

That distinction shifts the problem from model security to how identity and permissions are enforced across interconnected systems.<\/p>\n

Activity appears legitimate<\/h2>\n

Because actions are executed through trusted workflows using valid credentials, the activity may not trigger conventional security alerts.<\/p>\n

\u201cThe security risk isn\u2019t in the prompt,\u201d the report noted, but in how the workflows use \u201cprivileges the attacker does not possess.\u201d<\/p>\n

Dubey said this creates a detection challenge for defenders.<\/p>\n

\u201cThe individual events can look completely legitimate. The useful signals would come from correlating the original requester, the identity used downstream, the resources accessed, the parameters supplied, and the final action.\u201d<\/p>\n

Without that correlation, unauthorized access can blend into routine automation, Dubey added.<\/p>\n

Risk grows as attackers adopt agentic workflows<\/h2>\n

The timing of the finding adds to its significance. As enterprises expand AI-driven automation, attackers are also beginning to use similar multi-step workflows to carry out operations.<\/p>\n

In a recent blog post<\/a>, Google Threat Intelligence Group has described a shift from prompt-based misuse to more autonomous, agent-driven attacks that can plan and execute tasks across environments.<\/p>\n

That evolution increases reliance on the same execution layer highlighted in the Noma report, AI workflows that connect systems and act on behalf of users, amplifying the impact of any gaps in how identity and authorization are enforced.<\/p>\n

Shifting controls beyond the model<\/h2>\n

Noma Labs said mitigating the risk requires moving security controls beyond the model layer and into application and infrastructure design.<\/p>\n

\u201cMitigating these AI workflow risks requires shifting security controls from the model layer to application and infrastructure layers,\u201d Levi wrote.<\/p>\n

The report recommends enforcing identity-aware access at the point where actions are executed, including \u201cuser-context propagation\u201d and \u201cexplicit access-control and runtime protection evaluation steps\u201d between AI-generated outputs and downstream operations.<\/p>\n

Dubey said one way to test for the issue is to compare outcomes across users with different privilege levels.<\/p>\n

\u201cIf a low-privileged user can obtain the same result as an administrator because downstream systems only see the workflow\u2019s identity, that is where I would focus the investigation.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A newly identified AI attack technique can let unauthenticated users trigger privileged workflows and access enterprise systems, highlighting a gap in how identity and access controls apply to AI agents, according to research from Noma Labs. The report, authored by Noma Labs lead researcher Sasi Levi, describes the issue as \u201cworkflow identity hijacking,\u201d where attackers […]<\/p>\n","protected":false},"author":0,"featured_media":9412,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9411"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9411"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9412"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}