GoKawiilNoma Labs Exposes 'Workflow Identity Hijacking' Flaw in Enterprise AI Pipelines
Noma Labs researchers disclosed an authorization design flaw in enterprise AI pipelines that lets attackers submit ordinary-looking requests through unauthenticated channels—like support inboxes or web forms—to trigger actions using elevated internal permissions. They demonstrated this by sending a support email that tricked an AI workflow into retrieving and forwarding a finance director's private email contents to an attacker.