Full Report
Malicious actors can exploit default configurations in ServiceNow's Now Assist generative artificial intelligence (AI) platform and leverage its agentic capabilities to conduct prompt injection attacks. The second-order prompt injection, according to AppOmni, makes use of Now Assist's agent-to-agent discovery to execute unauthorized actions, enabling attackers to copy and exfiltrate sensitive
Analysis Summary
# Vulnerability: Second-Order Prompt Injection in ServiceNow Now Assist Agents
## CVE Details
- CVE ID: Not explicitly provided in the source text.
- CVSS Score: Not explicitly provided in the source text.
- CWE: Related to Improper Input Validation/Injection Flaws (e.g., CWE-94: Improper Control of Generation of Code, CWE-74: Improper Neutralization of Special Elements used in an Executable Sink context).
## Affected Systems
- Products: ServiceNow Now Assist generative artificial intelligence (AI) platform.
- Versions: Not explicitly listed, but the vulnerability is tied to default configurations enabling agent-to-agent discovery.
- Configurations: Exploitable when default configurations are used, specifically when:
* The underlying LLM (Azure OpenAI LLM or default Now LLM) supports agent discovery.
* Now Assist agents are automatically grouped into the same team by default.
* An agent is published as discoverable by default.
* Agents are not configured for supervised execution mode, and the autonomous override property (`sn_aia.enable_usecase_tool_execution_mode_override`) is not disabled.
## Vulnerability Description
Malicious actors can exploit a **second-order prompt injection** vulnerability within ServiceNow's Now Assist platform. This attack is facilitated by default configurations that allow agent-to-agent discovery and communication. An attacker embeds a specially crafted, malicious prompt into content that a benign agent is authorized to access (e.g., processing a help-desk ticket). This benign agent then unknowingly recruits a more privileged agent on the same team, redirecting its intended task to execute unauthorized actions against the organization's systems. Critically, these actions are executed with the privileges of the user who initiated the interaction, not the user who created the malicious prompt.
## Exploitation
- Status: PoC available (Implied by security research findings, but not confirmed as "in the wild"). The report states this is a discovery by AppOmni.
- Complexity: Medium (Requires understanding of agent architecture and embedding prompts in accessible content).
- Attack Vector: Network (via accessible content processed by a legitimate agent).
## Impact
- Confidentiality: High (Enables attackers to copy and exfiltrate sensitive corporate data).
- Integrity: High (Enables attackers to modify records).
- Availability: Low to Medium (Potential for disrupting automated workflows, though the primary impact is C/I).
## Remediation
### Patches
- No specific patch version number was released in the provided text. ServiceNow has updated documentation for clarity following responsible disclosure.
### Workarounds
- Configure **supervised execution mode** for privileged agents.
- **Disable the autonomous override property**: `sn_aia.enable_usecase_tool_execution_mode_override`.
- **Segment agent duties by team** to limit cross-agent dependency and communication paths.
- Review and adjust configuration settings related to LLM usage, tool setup, and channel defaults that govern agent discovery.
## Detection
- **Indicators of Compromise:** Monitoring agent execution logs for unexpected cross-agent invocations, particularly those originating from seemingly benign input processing tasks. Look for agent tasks that attempt to access or egress data beyond their standard operational scope.
- **Detection Methods and Tools:** Actively monitor AI agent behavior for suspicious activity that deviates from learned or intended operational patterns, especially when interacting with privileged resources.
## References
- Vendor Advisory: ServiceNow has updated documentation following responsible disclosure.
- Research Link: hxxps://appomni.com/ao-labs/ai-agent-to-agent-discovery-prompt-injection
- News Article: hxxps://thehackernews.com/2025/11/servicenow-ai-agents-can-be-tricked.html