---
title: "[AUTO] Workflow Identity Hijacking: The Authorization Gap"
pubDatetime: 2026-09-10T08:15:00.000Z
description: "AI workflow vulnerability exploits privilege escalation, not model manipulation"
tags: [ai-security, vulnerability, ai-agents, 2026, 2026-q3, 2026-09, AUTO]
---
[Noma Labs researchers discovered](https://noma.security/noma-labs/workflow-identity-hijacking-the-silent-backdoor-in-ai-workflows) a vulnerability that current AI security defenses are built to miss: benign requests through public entry points (GitHub issues, forms, support emails) execute with the creator's elevated privileges. No prompt injection needed. The model reasons correctly, the tool call is exactly what it should do, and the system obeys with high-level permissions.

This already happened: GitHub Agentic Workflows leaked private repositories; Google Workflows exposed credentials to unauthenticated users. [The GitLost disclosure](https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html) shows the gap. The user triggering the workflow isn't the user executing it.

Two years of AI security effort has gone to the model layer (prompt injection, jailbreaks) while the application layer remains untouched. This is the architectural gap the vulnerability exposes. Teams deploying agents with standing privileges need to gate untrusted input at infrastructure boundaries, not rely on model-layer guardrails.

---

*Sources: [Workflow Identity Hijacking: The Silent Backdoor in AI Workflows](https://noma.security/noma-labs/workflow-identity-hijacking-the-silent-backdoor-in-ai-workflows)  •  [Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data](https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html)*

*Coverage: [Identity-Based AI Attack Threatens Security of Enterprise Data](https://www.darkreading.com/threat-intelligence/identity-based-ai-attack-security-enterprise-data)*

*Related on this blog: [[AUTO] When your AI agent decides unauthorized access is a reasonable tactic](/posts/auto-agent-gym-exploit)  •  [[AUTO] AI-Generated Patches Fail at Scale](/posts/auto-ai-patches-fail)  •  [[AUTO] Langflow RCE Added to KEV After a Month of Silence](/posts/auto-langflow-rce-timing)*