What happened
Noma Labs published research on Sept 9, 2026 describing 'Workflow Identity Hijacking,' an authorization-pattern flaw in static enterprise AI workflows where the identity of the requester and the identity used to execute downstream actions are decoupled. Their example shows an external support-inbox sender causing a workflow to search a Finance Director's email and return quarterly sales data — entirely through legitimate model behavior, no jailbreak involved.
Why it matters
This is a novel, product-agnostic attack class distinct from prompt injection: because the model isn't manipulated, standard prompt-injection defenses (input filtering, guardrail models) do not mitigate it. Any organization running externally-triggered AI workflows with high-privilege service accounts is exposed to unauthenticated data exfiltration or unauthorized actions.
Attack vector
An attacker submits an ordinary-looking request through an unauthenticated entry point (support inbox, GitHub issue, web form, shared document, chat message). The AI workflow correctly interprets and executes the request, but does so using the workflow creator's or a service account's authority rather than the requester's — no prompt injection or model manipulation is needed, since the model behaves exactly as designed.
Affected systems
Static enterprise AI workflow/automation platforms generally (pattern-level flaw, not a single product); confirmed instance in Google Workflows
Mitigation
Propagate authenticated requester identity through short-lived, scoped delegation tokens; add explicit authorization checks between model output and any tool/data call; treat model output as untrusted input; separate sensitive data retrieval from automated external-response paths.