• Second-order prompt injection: Hidden instructions in data fields trick agents into enlisting others, amplifying attacks across the platform.

• Default agent discovery and team grouping in Now Assist make coordinated exploits easier for malicious actors.

• AppOmni reports that 80% of organizations may overlook these configurations, exposing internal systems to risks like data theft.

Discover the ServiceNow Now Assist AI exploit risks and how default settings enable prompt injection attacks. Learn protection strategies to secure your AI agents today (152 characters).

What is the ServiceNow Now Assist AI Exploit?

The ServiceNow Now Assist AI exploit involves a vulnerability in the platform’s default configurations that allows malicious actors to perform unauthorized actions via AI agents. As detailed by SaaS security experts at AppOmni, this flaw enables second-order prompt injection attacks, where hidden instructions in data fields trigger chain reactions among collaborating agents. This can result in data theft, record alterations, or escalated privileges without breaching user accounts directly.

How Does Agent Discovery Lead to Vulnerabilities in Now Assist?

ServiceNow’s Now Assist platform features AI agents designed to discover and collaborate automatically, a key selling point for seamless workflows. However, this interconnected setup becomes a liability when agents read unsanitized data. Aaron Costello, Chief of SaaS Security at AppOmni, explains that an attacker can embed malicious prompts in fields processed later, recruiting other agents to execute harmful tasks. For instance, a low-privilege user might plant instructions that activate during a high-privilege workflow, granting undue access. AppOmni’s analysis shows this “expected behavior” from default options affects many deployments, with agents inheriting the initiator’s permissions but expanding reach through delegation.

Supporting data from AppOmni indicates that organizations often deploy agents to default environments like the Virtual Agent or Developer panel, where discoverability is enabled by default. The platform’s AI ReAct Engine and Orchestrator facilitate this by routing tasks among team members, but without strict controls, it opens doors to escalation. Costello emphasizes, “This isn’t a bug—it’s how the system is built, making awareness crucial for security.”

Expert insights from LLM developers at Perplexity highlight broader implications, noting novel attack vectors in AI systems that emerge from integrated architectures. Similarly, software engineer Marti Jorda Roca of NeuralTrust warns of inherent security dangers in AI, urging proactive configuration reviews to mitigate risks.

Frequently Asked Questions

What Causes the Second-Order Prompt Injection in ServiceNow Now Assist?

The second-order prompt injection in ServiceNow Now Assist stems from agents processing stored data containing hidden malicious instructions. When an agent reads this data during normal operations, it can unwittingly delegate tasks to others, leading to unauthorized actions like data exfiltration. AppOmni recommends reviewing agent permissions and disabling auto-discovery to prevent this 45-word vulnerability.

Can ServiceNow AI Agents Be Secured Against Coordinated Attacks?

Yes, securing ServiceNow AI agents against coordinated attacks involves customizing configurations to limit discovery and collaboration. Disable automatic team grouping, mark agents as non-discoverable where possible, and implement data validation before processing. This approach, advised by security firm AppOmni, ensures agents operate in isolation, reducing the risk of chain reactions sounding natural for voice queries.

Key Takeaways

• Understand Default Risks: Now Assist’s auto-discovery enables efficient workflows but exposes systems to prompt injection if not monitored closely.
• Implement Controls: Customize agent teams and permissions to prevent inheritance of privileges from low-level inputs, as per AppOmni’s findings.
• Conduct Audits: Regularly review configurations and train teams on AI security to stay ahead of evolving threats like those noted by Perplexity.

Conclusion

The ServiceNow Now Assist AI exploit underscores the double-edged nature of advanced AI integrations, where agent discovery and collaboration drive innovation but invite second-order prompt injection vulnerabilities. By addressing default settings and adopting robust security practices, organizations can safeguard against data breaches and privilege escalations. As AI platforms evolve, staying vigilant with updates from experts like AppOmni will be essential to protect enterprise systems moving forward.