ServiceNow Now Assist AI Agents Vulnerable to Second-Order Prompt Injection Attacks

Security researchers have identified that ServiceNow's Now Assist generative AI platform is susceptible to second-order prompt injection attacks due to its default agent-to-agent discovery and collaboration features. Attackers can exploit these configurations to manipulate benign AI agents into recruiting other agents with broader privileges, enabling unauthorized actions such as data exfiltration, record modification, privilege escalation, and sending emails, all without the victim organization's awareness. The vulnerability is not a flaw in the AI itself but stems from expected behavior defined by default configuration options, which are often overlooked by administrators.

The research, conducted by AppOmni, highlights that even with built-in prompt injection protections enabled, malicious prompts embedded in accessible content can trigger a chain reaction among agents. The system's inability to distinguish between trusted instructions and untrusted data, combined with the orchestrator's role in assigning tasks, increases the risk in multi-agent environments. The issue is exacerbated by the fact that large language models prioritize task completion, making them susceptible to treating maliciously crafted text as legitimate instructions, thereby allowing attacks to bypass existing security controls.