Loading story…
Researchers disclosed Workflow Identity Hijacking, an authorization-design weakness in enterprise AI automations that lets an unauthenticated party submit a benign request through channels such as public inboxes, web forms, issue trackers, support platforms, shared documents, or chat. The workflow can then invoke connected tools using a privileged non-human identity, service account, developer API key, or creator credential, potentially retrieving and returning internal data to the attacker.
The exposure does not require prompt injection, model jailbreaking, credential theft, or model manipulation: the AI and its tools perform their intended functions, but the original requester's identity and permissions are not carried into downstream actions. Defenders should inventory AI workflows and associated privileges, trace untrusted inputs, bind sensitive operations to authenticated requester authorization, replace persistent administrative credentials with short-lived scoped tokens, separate sensitive-data retrieval from external responses, treat model output as untrusted, and log requester-to-action authorization context.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Noma Security researchers identified Workflow Identity Hijacking, an authorization-design weakness in which an untrusted requester can trigger an AI workflow that acts with a privileged non-human identity without validating the requester’s entitlements. The issue can enable unauthorized access or disclosure of internal data without prompt injection, model jailbreaking, or credential theft.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcesecuritymagazine.com
Open sourcenoma.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports warn that the most immediate AI security risk is **attackers hijacking trusted workflows**—AI copilots/agents, CI pipelines, SaaS admin planes, and identity control points—rather than “AI” being a standalone threat category. Commentary and research highlight how prompt-injection-style techniques can turn normal user actions (e.g., clicking a legitimate-looking link) into **silent data exfiltration** or unsafe tool use, and how autonomous agents can still complete scams even when they can correctly label a page as phishing. 1Password introduced an open-source benchmark, **Security Comprehension and Awareness Measure (SCAM)**, to test whether AI agents behave safely in realistic workplace tasks (email triage, link clicking, retrieving credentials from a vault, and form-filling) using production-like APIs; in testing, models that could identify phishing when asked still proceeded to **retrieve and submit real credentials** during routine workflows. Microsoft research described **AI recommendation poisoning** affecting 31 companies across 14 industries, where hidden instructions embedded in “*Summarize with AI*” links attempt to inject persistent directives into an assistant’s memory via URL prompt parameters, biasing future recommendations (e.g., prioritizing a specific domain/company). Separately, identity-focused analysis argues that as AI increases automation and API-driven decisioning, **identity becomes the enterprise control plane**, making IAM architecture and resilience (including where policy evaluation and authorization live) a central security concern at “AI scale.” Two SC Media opinion pieces broaden the theme: one ties recent supply-chain and developer-workflow compromises (e.g., malicious packages/actions and token theft) to the same “trusted workflow” abuse pattern, while another discusses mobile apps as an early-warning surface for supply-chain risk (including AI arriving via third-party SDKs), but it is more forward-looking guidance than incident reporting.
Jun 29, 2026
Enterprise adoption of AI agents is rapidly expanding the number of non-human identities inside corporate environments, with organizations increasingly running mixed stacks of coding assistants, writing tools, enterprise search, and agentic systems rather than relying on a single provider. Reporting based on Okta sign-on data from more than 20,000 organizations says each added AI platform brings more logins, secrets, tokens, service accounts, and permissions, while many companies still authorize agents with static API keys, OAuth apps, shared human accounts, or other weakly governed credentials that reduce auditability and increase the risk of over-permissioned access and orphaned accounts. Security reporting and industry data indicate that those governance gaps are already translating into higher exposure. The articles cite the `UNC6395` campaign, in which attackers allegedly abused a trusted OAuth token linked to Salesloft's Drift chat integration to pivot through Salesforce environments and obtain additional secrets including AWS credentials and Snowflake tokens, showing how machine identities can be exploited without a software flaw. A 2026 identity security report also found a 43% breach rate among organizations reporting AI-driven identity growth, versus 11% where AI had not significantly expanded identity counts, prompting calls for continuous inventory, clear ownership, least-privilege controls, lifecycle management, audit logging, and Zero Trust enforcement for AI agents and other machine identities.
Aug 20, 2026
Reporting and commentary warn that **AI-driven non-human identities (NHIs)** are rapidly increasing the number and turnover of credentials inside enterprise IAM programs, amplifying long-standing weaknesses such as credential sprawl, unclear ownership, and inconsistent lifecycle controls. The Cloud Security Alliance’s findings highlight that many organizations treat *AI identities* like traditional service accounts or API keys, causing them to inherit existing governance gaps while adding new scale and speed pressures as identities are created programmatically, distributed across environments, and used continuously. CSO Online describes the operational drivers behind the surge—microservices, Kubernetes auto-scaling, CI/CD pipelines (e.g., GitHub Actions), and infrastructure-as-code (e.g., Terraform) generating large volumes of short-lived tokens and service principals—then argues that **agentic AI** further accelerates risk because these identities may be authorized to execute commands, move data, and change configurations autonomously. The net risk emphasized is that over-privileged AI agents and other NHIs can create breach conditions that may not resemble traditional intrusion, instead appearing as “normal” automated activity due to excessive permissions and weak visibility into post-authentication behavior.
Jul 1, 2026