How did the flight attendant that phoned the control tower from the plane to them know that the plane was probably being hijacked break protocol?

The flight attendant who phoned the control tower recognized signs of a possible hijacking, such as unusual behavior from passengers or crew members, and instinctively chose to communicate directly with air traffic control. This action broke protocol, as flight attendants are typically not authorized to make such direct contact without going through the captain. Her decision to bypass standard communication channels was driven by the urgency of the situation and a desire to alert authorities quickly.