A new AI security threat, workflow identity hijacking, exploits authorization design flaws in enterprise AI pipelines to trigger data exfiltration through privileged identities, even when the model itself remains unchanged.

Attackers bypass controls by sending unauthenticated requests through entry points like support inboxes, GitHub issues, web forms, or shared documents, taking advantage of the separation between the triggering user’s identity and the executing permissions.

The core mechanism is that the user’s identity who starts a workflow is separated from the permissions used to run it, causing workflows to operate with high-privilege access on behalf of unauthenticated requesters during downstream actions.

Recommended controls center on ongoing identity verification, document authenticity checks, interview integrity, secure device delivery, access governance, continuous monitoring, and periodic evaluation.

A longer version and glossary emphasize non-human identities and the author’s experience building audit layers for agents that write to production systems.

Implementation guidance includes scoping to fields rather than objects when possible, assigning human owners and expiries, embedding workflow names in identities for traceability, and ensuring quick deactivation of the latest integration to avoid cascading failures.

The piece argues for shifting from static policy docs to verifiable, end-to-end controls that prove who has access to what data at any moment, enabling safe deployment of AI agents to sensitive data when governance is aligned.

Integrations often run with admin-like privileges due to overly broad permissions, creating long-term risk as accounts accumulate extensive access.

To combat AI-assisted employment fraud, extend continuous verification from technology to the workforce, ensuring trust is earned rather than assumed at hiring.

Trust in workforce access must be earned through ongoing verification, not merely at onboarding.

Guardrails based solely on model behavior aren’t enough; enforce permissions, identity propagation, and access controls at each workflow step, and replace persistent API keys with short-lived tokens.

Gaps include identity, encryption, and visibility into shadow AI, with identity controls being the fastest yet hardest fix across legacy systems, and encryption alone not stopping AI leakage.