Can you prove your automated workflows can't be hijacked?
Teams automate real work (payments, data syncs, customer messages) with workflow tools like n8n, Zapier, Make, and Power Automate. WorkflowBench is an open, run-it-yourself test that scores how well those tools stop a workflow from being hijacked, tampered with, or leaked. It covers six attacks specific to workflows that agent-focused benchmarks miss.
Six workflow-specific attacks, 30 scenarios, all six measured on Agentomy: 30 of 30 blocked. On n8n, trigger-spoofing is 5 of 5 blocked when governed and 5 of 5 skipped when not, because plain n8n has no ingest-adjudication endpoint to test. Run the same suite yourself.
Why workflows need their own benchmark
A workflow is a chain of connected steps. That creates risks a single AI agent doesn't have.
A workflow tool runs a chain of steps: something triggers it, then each step passes its output to the next. Our other benchmark, GovernanceBench, scores the governance of a single AI agent: is it allowed to take an action, is every action written to a tamper-evident log, can a human halt it instantly, is its behavior watched for drift. Those checks matter when one agent is calling tools. They do not cover what can go wrong inside a workflow tool that runs a trigger-driven chain of steps.
WorkflowBench is the sibling benchmark: same free, open-source license (Apache 2.0), the same run-it-yourself approach, and the same rule that a published score has to come from a real, reproducible measurement. It focuses on workflow-shaped risks. Each of the six threats below matches one control a workflow tool should provide.
Six workflow-specific threats
What WorkflowBench measures.
WGB-T-A
Fake triggers (trigger-spoofing)
A workflow starts when something triggers it: an incoming web request (a webhook), a timer, an email, or an event from another app. If an attacker forges or hijacks that trigger, the workflow runs when it shouldn't. A pass means the tool checks who really sent the trigger and verifies its signature before any step runs.
WGB-T-B
Poisoned hand-off (cascade-poisoning)
A step that calls an AI model (an LLM, or large language model) produces text you can't fully trust. If that text flows straight into a later step with real power (sending money, deleting data), a poisoned message can cause a harmful action. A pass means each step's input is cryptographically tied to the step that produced it, so tampering is caught.
WGB-T-C
Hidden actions (audit-bypass by reordering)
Whoever builds the workflow could move or delete the step that writes the audit log, so a sensitive action goes unrecorded. A pass means the tool writes its own log entry that the workflow's author cannot move or switch off.
WGB-T-D
Bleed-over between workflows (cross-workflow leak)
Many workflows run on the same tool. A pass means one workflow's records and secrets stay walled off from another's: no logs or credentials leaking from one workflow into the next.
WGB-T-E
Malicious add-ons (supply-chain)
Workflow tools let you add community-built steps, called nodes. A malicious one can quietly steal data or run hidden actions. A pass means the tool inspects each add-on before it runs and blocks the dangerous ones.
WGB-T-F
Rewritten history (workflow-replay tampering)
You should be able to re-run a workflow's recorded history and get the exact same audit trail. A pass means the whole run is protected by a chain of cryptographic checks, so any after-the-fact tampering is detected.
Tested live · Tier 1 (measured scores)
Run it. Compare it. Verify it.
We only publish a numeric score when we can run the test against a live, running copy of the tool and anyone else can reproduce it. Tools we could only assess from their documentation are listed further down, without a score.
| Platform | Measured score | Suite | Reproduce |
|---|---|---|---|
| n8n with Agentomy governance | 100 / 100 | Fake triggers, 5 / 5 blocked | npx agentomy-workflowbench run --adapter agentomy --target http://localhost:3000 |
| Plain n8n (version 1.x) | N / A | 5 of 5 tests skipped: no control to test | npx agentomy-workflowbench run --adapter n8n --target http://localhost:5678 |
N / A for plain n8n is not a failure. It is the honest result when the tool has no feature to score. Plain n8n has nothing that inspects an incoming trigger and decides whether to allow it, so all 5 fake-trigger tests skip with the message "Skipped: target lacks ingest-adjudication endpoint." The fair read: plain n8n can't be scored on this at all; add Agentomy governance and it scores 100 / 100 on the same test.
Tier 2 · Reviewed on paper (no score yet)
Tools we've only been able to review from their docs, so far.
These tools don't offer a running version we can point the test at, so they can't earn a numeric score yet. We review them from their public documentation and move them up to a live, scored test as soon as we can run against them.
| Platform | Why we can't score it live yet | Status |
|---|---|---|
| Zapier | Closed-source and cloud-only; no public way to test its governance. | Reviewed on paper |
| Make (Integromat) | Closed-source and cloud-only; no public way to test its governance. | Reviewed on paper |
| Pipedream | Partly open-source, but per-account governance isn't exposed to test. | Reviewed on paper |
| Tray.io | Closed-source enterprise service; no runnable copy to test. | Reviewed on paper |
| Workato | Closed-source enterprise service; its governance isn't publicly testable. | Reviewed on paper |
| Microsoft Power Automate | Closed-source and Microsoft-hosted; governance runs through Microsoft's own tools (Purview and Entra), which WorkflowBench can't drive directly. | Reviewed on paper |
| Apache Airflow | Open-source and can be self-hosted; a live, scored test is in progress. | Live test coming |
| Temporal | Open-source and can be self-hosted; a live, scored test is in progress. | Live test coming |
Reproducible by anyone
Run it yourself and get the same numbers.
Both Agentomy and WorkflowBench are free and open-source (Apache 2.0). Download the code, start the tool you want to test, and run the benchmark. No sales call and no signup. The same code and the same containers produce the same scores. The commands below do exactly that.
# Spin up bare n8n docker compose -f n8n-measurement/docker-compose.yml up -d until curl -sk http://localhost:5678/healthz | grep -q ok; do sleep 3; done # Spin up Agentomy governance server (governed routing destination) docker compose up -d agentomy until curl -sk http://localhost:3000/health | grep -q healthy; do sleep 3; done # Bare n8n npx agentomy-workflowbench run --adapter n8n --target http://localhost:5678 --suite trigger-spoofing # Agentomy-governed npx agentomy-workflowbench run --adapter agentomy --target http://localhost:3000 --suite trigger-spoofing
What each plan tier unlocks
Free open-source steps, with paid tiers unlocking stronger controls.
The @agentomy/n8n-nodes package (a free, open-source add-on for n8n) is free to install. Each step it adds routes through Agentomy's governance server, and the stronger controls unlock by plan tier. The free Evaluator tier lets you verify workflows and run WorkflowBench. Higher tiers (Analyst, Builder, Operator) unlock more controls. Pick the lowest tier that covers what your workflows need, and upgrade only when you need the next control. The middle column below lists the underlying server feature (the developer-facing name) alongside a plain description of what it does.
| Workflow step | What it does (server feature) | Lowest tier |
|---|---|---|
| Agentomy: Authorize | Checks every action against your rules before it runs. enforcement.evaluate | Analyst |
| Agentomy: Audit Action | Writes and reads a tamper-evident log, and can format it for your security team's log dashboard (known as a SIEM, for security information and event management). audit.read.own (free) + siem.format (Analyst tier) | Evaluator+ |
| Agentomy: IPI Guard | Catches hidden instructions smuggled in through data, an attack known as indirect prompt injection (IPI). ipi.adjudicate (new) | Analyst |
| Agentomy: Policy Check | Tests an action against your policy without running it. enforcement.evaluate | Analyst |
| Agentomy: Halt Trigger | Stops a workflow the moment a halt is ordered. Listens for halt.agent.single events. | Operator |
| Agentomy: Workflow Attestation | Cryptographically signs each run so it can't be forged or replayed. attestation.workflow (new) + provenance.record | Builder |
| Agentomy: Skill Bind | Only loads approved, verified add-on steps. skill.registry.read + skill.verify | Analyst |
| Agentomy: Skill Verify | Scans an add-on step for malicious behavior before it runs, using a security scanner called SkillSpector. skill.verify | Analyst |
| Agentomy: Workflow Isolate | Keeps each workflow's logs and secrets walled off from the others. audit.isolation.workflow (new) | Builder |
| WorkflowBench CLI | Runs the WorkflowBench tests yourself from the command line. benchmark.workflow (new; the workflow version of the benchmark.governance command) | Evaluator (free) |
One master list defines what each tier includes, and it drives the developer library, the dashboard, and the command-line tool alike: you can query it at GET /api/tiers. Whenever the service blocks something, the response tells you exactly which tier unlocks it. See the full 5-tier plan on the tiers page.
Workflow governance is measurable. The benchmark is open.
WorkflowBench is the first open, run-it-yourself governance score for workflow tools. Free and open-source (Apache 2.0). No sales call.
View on GitHub