Enterprise AI workflows can be vulnerable to misuse that exposes sensitive information without prompt injection, account compromise, or jailbreaking a large language model.

This vulnerability, termed Workflow Identity Hijacking, exploits authorization gaps between external requesters and the privileged identities used by AI automation.

Workflows linked to public-facing email inboxes, web forms, GitHub issues, shared documents, customer support systems, and chat platforms can be at risk.

An attacker might only need to submit an innocuous-looking request for an AI workflow to retrieve and disclose information, leveraging permissions that the attacker does not possess.

For instance, imagine an attacker emailing a company’s public support address, requesting the latest quarterly sales figures mentioned in an executive’s email.

Hackers Turn AI Workflows Into Data-Stealing Proxies

If an AI workflow is designed to read incoming messages, search internal mailboxes or data sources, and respond automatically, it may comply.

The danger lies not in malicious phrasing but in the workflow’s ability to access internal data using a privileged service account or the creator’s credentials. Noma Labs highlights that this creates a covert path for data exfiltration.

The AI model does not need to disregard instructions, bypass safeguards, or engage in unintended actions. Instead, it follows its assigned tasks, while the automation performs downstream actions with excessive privileges.

This issue highlights the distinction between Workflow Identity Hijacking and traditional prompt injection attacks. In a prompt injection attack, the aim is to manipulate the model’s behavior through direct or indirect manipulation.

However, Workflow Identity Hijacking focuses on the legitimacy of the request itself: a chief financial officer may rightfully request sales data, while an anonymous external sender asking the same question is not authorized.

Traditional AI safeguards often fail to differentiate between such requests, as both appear harmless from a language-model perspective.

Input filters and model guardrails detect attempts to alter model behavior but do not necessarily verify whether the requester has the proper permissions.

The core security flaw emerges when the requester’s identity is disconnected from the identity executing the workflow. This allows unauthenticated external users to influence workflows while accessing data through privileged developer API keys, service accounts, or admin-controlled integrations.

AI workflows, unlike agentic workflows which can adaptively select tools and actions to meet goals, are generally predictable. They follow a predetermined process where input enters, an LLM analyzes it, and fixed actions execute afterward.

This deterministic design can create a false sense of security, leading teams to focus on restricting tool use while neglecting static automations linked directly to internal systems.

Even scheduled workflows remain susceptible. If only administrators can configure or launch them, workflows still process inputs from untrusted sources, such as inboxes or ticket queues.

To enhance security, organizations should evaluate AI workflows by identifying the least-trusted party influencing their inputs. Security teams must pinpoint every untrusted content source and specify permissions at each step.

Effective defenses include ensuring the authenticated requester’s identity propagates through the workflow, replacing persistent administrative API keys with short-lived scoped tokens, and enforcing authorization checks before any sensitive actions are taken.

Moreover, companies should treat large language model outputs as untrusted data. Any workflow step that uses model output for actions should involve separate policies and access-control checks.

Sensitive data retrieval should also be distinct from automated external responses to prevent workflows that can access finance records or private emails from sending results to unauthenticated users.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models appeared first on Cyber Security News.