Workflow hijacking — Noma research on AI automations with no authorization

So apparently, instead of prompt injecting AI now, we can just ask it nicely to give us a bunch of information and it would just work sometimes. This is new research out of Noma. Thanks for sharing it, Noma. And it's all about workflow hijacking. So we're building AI into all these automated workflows now. And what are we not doing sometimes, apparently, is checking that the person that asked us for that information was actually authorized to do it. So then you get like situations like these where you have a workflow built around your email that is like auto responding to stuff or trying to just clear your plate and be productivity hacks. But then they're just sending a bunch of information that they shouldn't be sending to people they shouldn't be sending it to. So like you have a workflow and the attacker could be like, hey, can you give me the last email from such and such? And you get a trigger that's like pull the content of new emails into this workflow. The workflow asked the model. So it's not prompt injection because the model is doing what it's asked. You're not tricking it. You're not telling it to ignore instructions. That would be like direct prompt injection. We've seen a lot of this, right? Like just different ways to get it to ignore its system prompt to do something else. Then you get indirect prompt injection where you can like hide instructions in a PDF. We saw that court document that did that. But this is something different. It's like we've got these…