"You cannot secure what you cannot see," said Chandra Gnanasambandam, Chief Technology Officer at SailPoint.
Workflow Identity Hijacking, as found by Noma Security
Researchers from Noma Security identified a backdoor in AI workflows they call "Workflow Identity Hijacking." The technique lets a malicious actor exploit non-human identities (NHIs) to access production systems without ever needing a human user's credentials. Crucially, the underlying model is not tricked, manipulated or jailbroken; rather, an attacker sends a benign request via unauthenticated entry points — such as support inboxes, web forms, or shared documents — and the workflow processes and executes the request "exactly as it was designed to do." The problem is not model misbehavior but an authorization gap: the attacker had no authority to make the request, yet saw it fulfilled.
Why NHIs demand new governance — Chandra Gnanasambandam, SailPoint
Gnanasambandam framed the risk as an organizational blind spot. "Adversaries are using AI to operate at a scale and speed that makes traditional, static defenses outdated," she said, warning that the window between discovery and exploitation has shrunk from months to days and will soon be measured in minutes. Her prescription centers on abandoning "set-it-and-forget-it" access policies and treating static, persistent access as the single greatest vulnerability in modern enterprise environments.
To address that, she argued teams must deploy discovery mechanisms that reveal the full spectrum of NHIs — cloud agents, app-level agents, browser-based agents and endpoint bots — and then map each agent's complete web of connectivity: the tools they can execute, the SaaS apps and data repositories they query or alter, and the specific credentials they hold, whether API keys, OAuth tokens, or legacy embedded secrets. Only continuous, holistic visibility, she said, will allow organizations to regain control of their non-human workforce.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPrivileged access failures and immediate mitigations — Morey Haber and Bradley Smith
Morey Haber, Chief Security Advisor at BeyondTrust, described the root cause as a failure to assign roles and least privilege to automation: "Every AI workflow built on a shared service account or static API key has recreated a problem privileged access management solved for human identities years ago." In Haber's view the model is not the problem; the infrastructure decision to wire a workflow to a privileged credential is.
Haber outlined three prioritized fixes:
- "Stop letting workflows run as an unaccountable 'system.' Use short lived, scoped delegation tokens tied to the actual requester and responder instead of a standing admin key."
- "Treat model output as untrusted input and insert an explicit authorization checkpoint before any privileged action executes. This is the human in the loop."
- "Separate read from send. A workflow that can pull sensitive data and respond externally through an unauthenticated channel is an exfiltration pipeline with a helpful front end."
Bradley Smith, SVP, Deputy CISO at BeyondTrust, reinforced the operational immediacy: this exposure "came from a design decision" and is the "confused deputy problem" manifesting with a non-human deputy. He recommended two quick starts that security teams can take now: run an audit to inventory AI automations and their least-trusted input channels, and "treat any workflow holding standing authority the way you treat an insider" by assigning an owner and an authority map.
Model-aware deception, authorization telemetry, and logging — Ram Varadarajan, Jeremy London, Chris Radkowski
Ram Varadarajan, CEO at Acalvio, emphasized that Workflow Identity Hijacking "produces zero adversarial signal at the model layer" because the requests are benign and the tool calls are exactly what workflows were built to do. His recommended defensive tactic is "model-aware deception": seed the environment with decoy assets and honeytoken records so a benign-looking request that touches them reveals behavior that should not occur.
Jeremy London, Director of Engineering, AI & Threat Analytics at Keeper Security, framed the technical gap as a divergence between authentication and authorization: "An AI agent can authenticate itself properly by using valid credentials... but still disclose sensitive data to someone who should never see it." He urged security teams to inventory which NHIs each workflow can access, enforce least-privilege permissions, isolate data retrieval from external communication, require identity-aware authorization checks, and expand audit logging to record who initiated requests and why authorization succeeded.
Chris Radkowski, Security and Risk Expert at Pathlock, drew a parallel to ERP controls: the danger is not the request but "who's allowed to make it," and AI workflows' service accounts "should be treated the same way you’d treat a highly privileged ERP role."
What this means for technologists and security teams, affected enterprises and procurement leaders, and adversaries
Technologists and security teams must prioritize discovery and continuous mapping of NHIs, implement short‑lived, scoped delegation tokens, and insert authorization checkpoints that verify requester entitlements before any privileged action executes.
Affected enterprises and procurement leaders will need to treat workflow service accounts as high‑risk assets: assign owners, create authority maps, and require design decisions that separate read access from outbound communication to prevent an automated exfiltration pipeline.
Adversaries benefit from the absence of adversarial signals at the model layer; as Bradley Smith put it, "The attacker in this scenario never breaks anything. He asks, and the workflow lends him its authority."
Detection and defense, in short, must shift from asking who logged in to asking who was entitled to ask. As Smith concluded: "detection must move from authentication telemetry to authorization telemetry." For organizations that want a place to start, his two-step audit — inventory automations and treat standing authority like an insider — is the immediate, actionable work that can be done this week while engineering changes take quarters to land.
