SECURITY researchers have identified a new AI-driven attack flow dubbed “workflow identity hijacking,” which exploits an authorisation design flaw in modern enterprise AI pipelines. The gist is that threat actors can bypass standard security controls by sending what appears to be a normal, benign request through an unauthenticated entry point—such as a support inbox, GitHub issue, web form, or shared document—and have the organisation’s AI workflow execute actions with elevated privileges.
The flaw arises because the AI pipeline decouples the identity of the external requester from the permissions used to execute the workflow, meaning the requester has no real authority to trigger the action, yet the workflow proceeds as designed.
The article contrasts AI workflows with agentic workflows and explains how, in an AI workflow, the system reads the input and executes downstream actions using high-privilege service accounts or API keys rather than the external user’s permissions. This creates an unauthenticated proxy for privileged actions and can enable silent data exfiltration.
To defend against this vector, security experts recommend shifting controls from the model layer to application and infrastructure layers, including identity-aware token delegation (eliminating static API keys and using short-lived, scoped tokens), contextual authorisation checkpoints (treating LLM outputs as untrusted inputs and enforcing explicit access checks before database or tool calls), and asymmetric output separation (keeping data retrieval isolated from external messaging channels). Some also advocate model-aware deception, such as decoy assets, to reveal benign requests that overstep boundaries.