Noma Labs

Noma Labs is an AI safety and governance research organization focused on developing practical tools and frameworks for responsible AI deployment. The company creates solutions that help enterprises identify and mitigate risks in large language models and AI systems before they reach production. Their work matters for governance because it bridges the gap between academic AI safety research and real-world compliance needs that organizations face when scaling AI responsibly.

1 item

ResearchGlobal2026-09-10

Workflow Identity Hijacking Bypasses Every Existing Agent Authorization Control

Noma Labs researcher Sasi Levi has documented a technique called workflow identity hijacking, in which unauthenticated or low-privilege users trigger privileged AI workflows simply by submitting benign inputs through entry points such as support inboxes or web forms. The core flaw is a structural decoupling between the identity of the person who initiates a workflow and the identity used to execute downstream actions, allowing AI pipelines to proxy high-privilege service accounts without verifying the original requester's authorization. Standard prompt-injection defenses and conventional security monitoring do not detect this class of attack, because the executing service account is behaving as its configuration intends.

agentic AI identity and access management authorization controls AI pipeline security Noma Labs privilege escalation workflow security