Workflow Identity Hijacking is a reported attack pattern in which an apparently normal request abuses the identity, delegation, or authorization rules inside an automated workflow. Instead of attacking the model’s “understanding,” the attacker targets how the system decides who is allowed to trigger tools, move data, or complete a sensitive action.
This matters because agentic systems often split work across multiple components: one step accepts the request, another fetches data, and another executes the final action. If the workflow runs with broader privileges than the requester, a harmless-looking input can cause unauthorized data access or exfiltration. That makes the issue similar to a confused deputy problem, where a trusted system is tricked into using its authority on someone else’s behalf.
Defenses focus on preserving the chain of custody: bind each action to the originating user, limit delegated privileges, log who requested and who executed each step, and enforce authorization at every boundary between agents, tools, and data sources.