Nobody Approved This : Hijacking Approval Authority Across AI Agents and Workflows

A single database row changes. A paused workflow resumes, and an AI agent quietly hands an attacker the keys to a whole cloud account. No credential stolen, no reviewer fooled, no code run on the host. The system did its job exactly as designed.

 

A workflow pauses for approval before a protected action. The attacker changes the stored decision and adds the approver identity the workflow expects. Resume runs under the workflow's own credential, and the audit trail records an approval that never happened. A rejected payment turns approved. A forged code review turns into an admin role.

​

The attacker has neither approval rights nor the protected credential. All they can do is write to the state the workflow trusts on resume. Effect escalates, access does not.​