A serious vulnerability in ServiceNow's AI tools allows unauthenticated users to create backdoor admin accounts. Dubbed "BodySnatcher," this flaw highlights the risks of rapidly integrating AI features without proper security measures. ServiceNow has patched the issue, but potential risks remain due to custom configurations.

Malicious actors can exploit default settings in ServiceNow's Now Assist AI to execute prompt injection attacks, allowing unauthorized access to sensitive data. These attacks leverage agent collaboration features, making it easy for attackers to manipulate benign requests into harmful actions without detection. Organizations must reassess their configurations to mitigate these risks.