Nobody Approved This : Hijacking Approval Authority Across AI Agents and Workflows | AltSecCON 2026

This talk introduces "Approval Provenance Failure" (APF) — a vulnerability class where human approval gates in agent workflows and CI/CD pipelines can be forged by attackers with database write access, because frameworks record approvals but never verify their origin (0:03).

Key Takeaways:
• The EU AI Act mandates human review for high-stakes actions, yet ~90 systems evaluated; 43+ already lacked this guarantee (1:47).
• Real losses: European firms lost $28M; a US firm lost $36M when no legitimate human approval could be produced for a $112M transaction (2:55).
• Microsoft, Google, OpenAI, and Atlantis confirmed the findings but refused to patch, blaming developers — leaving attackers an open seam (5:42).
• Root cause: systems conflate recording vs. verifying approvals; a single flipped database value forges a forensically clean approval under any named approver (9:53).
• Five attack classes: Forge, Bind, Replay, Suppress, and Ladder (a small DB change can yield a cloud admin role via Terraform) (24:46).
• CERT confirmed APF as a new, widespread class across healthcare, finance, and cloud security; 26 of 43 disclosed systems were directly exposed (27:59).
• Mitigation: never treat persisted workflow state as final approval; verify provenance, single-use, and expiry — like UPI secures pin/biometric endpoints (11:51).

APF is a confirmed, cross-industry vulnerability class that vendors are declining to fix, so organizations must themselves verify approval provenance at every trust boundary rather than trusting persisted workflow state.

Sources:

• 0:03 Session intro
• 1:47 EU AI Act context
• 2:55 Financial losses
• 5:42 Vendor refusals to patch
• 9:53 Root cause analysis