Enterprise AI workflows are facing a novel threat known as Workflow Identity Hijacking, where attackers can exploit authorization gaps to access sensitive data without needing to manipulate model prompts or compromise accounts. This issue arises when workflows operating with privileged identities are tricked into disclosing confidential information, even with seemingly innocent requests. For example, an attacker could submit a simple request to a company's public support email asking for sensitive internal data, like sales figures, which an AI workflow might retrieve and disclose if it is designed to read and respond to such inquiries automatically.
The vulnerability does not involve the AI model performing unauthorized actions but rather the automation executing tasks with excessive privileges. Unlike prompt injection attacks, which manipulate AI behavior, Workflow Identity Hijacking takes advantage of the legitimate appearance of requests. This distinction highlights a significant gap in current AI security measures, as traditional safeguards often fail to verify the requester's permissions.
The core issue occurs when the identity of the requester is not linked to the identity operating the workflow, allowing unauthorized access through privileged accounts and API keys. The deterministic nature of AI workflows, where inputs are processed in a predictable manner, can lead to a false sense of security. Organizations might focus on tool restrictions rather than addressing the risks associated with static automations connected to internal systems.
To mitigate these risks, companies must reassess their AI workflows, identifying potential vulnerabilities introduced by untrusted input sources. By ensuring that requesters' identities are authenticated throughout the workflow and replacing static administrative keys with short-lived tokens, organizations can enhance their security posture. Additionally, treating large language model outputs as untrusted data and separating sensitive data retrieval from automated responses can prevent unauthorized data access.
