Noma Labs

In this novel attack vector disclosure by Noma Labs, Workflow Identity Hijacking is explained and documented. Described as a scenario where the underlying model is not manipulated, tricked, or jailbroken. Attackers are able to bypass standard controls by sending normal, benign requests through an unauthenticated entry point (such as a support inbox, GitHub issue, web form, or shared document). The enterprise AI pipeline reads the input, interprets the request, and executes the action exactly as designed. The core failure is that the requester had no authority to make that request. The root cause is an authorization design flaw in modern enterprise AI pipelines: the identity and permissions of the user who triggers a workflow are decoupled from the identity and permissions used to execute it.

Noma Labs found a critical (10 CVSS) vulnerability in Ruflo, an open source AI agent orchestration platform with more than 67,000 GitHub stars at the time of this writing and ranked #2 on MCPMarket. Ruflo ships with a chat UI, agent swarms, persistent memory, and MCP-based tool calling. The platform’s MCP Bridge, the Express.js server that handles all tool invocations, exposes 233 tools over HTTP with zero authentication. Noma Labs researchers got one of those tools to run arbitrary shell commands.

TL;DR: Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by posting a crafted GitHub Issue in a public repository belonging to the same organization as the private repositories. Noma Labs named the vulnerability GitLost.

At Noma, our mission is simple: identify and reduce emerging AI risk before it impacts your business. Following our discoveries of ForcedLeak, GeminiJack, and DockerDash, the Noma Labs Team has identified a new critical vulnerability: GrafanaGhost.

Trust is the most vulnerable component of the modern development stack. In our previous analysis of OpenClaw, Noma Security’s research team highlighted how “Fear of Missing Out” and the need for instant productivity lead teams to adopt new tools before they are properly vetted. Today, we are disclosing a critical vulnerability in Upstash’s Context7 MCP Server, one of the most popular MCP servers on GitHub, with approximately 50,000 stars and more than 8 million npm downloads.

Noma Labs discloses the discovery of DockerDash. DockerDash is a critical security flaw in Docker's Ask Gordon AI (beta) assistant that exploits the entire execution chain from AI interpretation to tool execution.

Noma Labs discovered GeminiJack, a critical indirect prompt injection vulnerability in Google Gemini Enterprise / Vertex AI search that completely collapses the trust boundary between user data and AI instructions.

Noma Labs discovered the ForcedLeak AI agent vulnerability chain which allows external attackers to exfiltrate sensitive CRM data through an indirect prompt injection attack, using a whitelisted domain that cost $5.