Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models
Enterprise AI tools can accidentally share private company data when attackers send fake requests to public email, chat, or support channels. The AI runs with high-level permissions, so it can read and send internal info without breaking its own rules.
- Report priority
- Medium
How it works
- Attackers send fake requests to public-facing email, chat, or support channels linked to an AI workflow.
- The AI tool reads the request and uses its own high-level permissions to search internal company data, like emails, sales figures, or customer records, without needing to trick the AI itself.
- The AI follows its programmed steps, but the attacker gains access to private data they should not see.
What to do
If your company uses AI tools tied to public email, chat, or support channels, like automated replies to customer messages or GitHub issue trackers, check if those tools can access internal company data. Look for AI workflows that read emails, search files, or pull data from private sources. If they do, an attacker could trick them into leaking that data by sending a fake request.
Review your company's AI workflows to see if they connect public-facing channels to internal data. Restrict AI permissions so they can only access what's needed for their task. For example, limit an AI chatbot to public FAQs instead of private emails. If you're unsure, ask your IT team to audit the workflows for risky data access.
Technical details
An attacker emails a company's public support address asking for the latest quarterly sales figures. The AI workflow, set up to read incoming messages and search internal emails, retrieves and sends the data back to the attacker, all without the AI ignoring its own rules or being hacked.
This vulnerability, dubbed Workflow Identity Hijacking, exploits misaligned permissions in AI-driven automation systems. Attackers can bypass traditional safeguards by submitting seemingly benign requests, such as a support email asking for internal data, to trigger workflows running under elevated privileges (e.g., service accounts or admin credentials). Unlike prompt injection, which manipulates model behavior, this flaw leverages the workflow's automated execution to exfiltrate sensitive data without altering the AI's responses.
Affected systems include AI workflows tied to public-facing channels like email inboxes, GitHub issues, or customer support platforms, where an attacker's request may be processed as if authorized by a legitimate user. The issue stems from a lack of identity verification in workflow triggers, allowing unauthorized actors to exploit privileged access embedded in automation logic.