ServiceNow AI Agents Face 'Second-Order Prompt Injection' Risks

Security researchers have uncovered a significant vulnerability in ServiceNow's Now Assist generative AI platform, dubbed "second-order prompt injection." This exploit allows malicious actors to manipulate AI agents into performing unauthorized actions, potentially leading to data exfiltration, record modification, and privilege escalation. The vulnerability stems from default configurations that enable agent discovery and inter-agent communication.

Key Takeaways

• ServiceNow's Now Assist AI agents are susceptible to prompt injection attacks.

• The exploit, termed "second-order prompt injection," leverages agent discovery and collaboration features.

• Attackers can trick agents into executing harmful actions like data theft or privilege escalation.

• The vulnerability is linked to default configuration settings, not an AI bug.

• ServiceNow has updated documentation but considers the behavior intended.

Understanding the Vulnerability

The core of the issue lies in Now Assist's agentic capabilities, which allow AI agents to discover and interact with each other. When these features are enabled by default, a seemingly harmless prompt embedded within accessible content can be used to recruit a more powerful agent. This recruited agent can then be instructed to perform malicious actions, such as reading or altering records, copying sensitive corporate data, or sending unauthorized emails.

Aaron Costello, chief of SaaS Security Research at AppOmni, highlighted that this is not a bug but rather a consequence of specific default configuration options. "When agents can discover and recruit each other, a harmless request can quietly turn into an attack," Costello stated. He further noted that these settings are easily overlooked, making organizations potentially vulnerable without realizing it.

How the Attack Works

Second-order prompt injection exploits the cross-agent communication enabled by controllable settings, including the default Large Language Model (LLM) used, tool configurations, and channel-specific defaults. The attack vector requires:

• An underlying LLM that supports agent discovery (Azure OpenAI LLM and ServiceNow's default Now LLM do).

• Now Assist agents being grouped into the same team by default, allowing them to invoke each other.

• Agents being discoverable by default when published.

When an agent's primary task involves reading data not directly provided by the user initiating the interaction, it becomes a potential target. An attacker can then redirect a benign task assigned to an innocuous agent into a harmful operation by leveraging the functionalities of other agents within the same team.

Crucially, these malicious actions often occur discreetly, unbeknownst to the victim organization. The agents operate with the privileges of the user who initiated the interaction, not necessarily the user who created the malicious prompt.

ServiceNow's Response and Mitigation Strategies

Following responsible disclosure of these findings, ServiceNow has updated its documentation to provide greater clarity on the matter, though the company maintains that the behavior is intended. This situation underscores the growing need for robust security measures as enterprises increasingly integrate AI into their workflows.

To mitigate these prompt injection threats, security experts recommend several strategies:

• Configure supervised execution mode for privileged agents.

• Disable the autonomous override property (sn_aia.enable_usecase_tool_execution_mode_override).

• Segment agent duties by team to limit their scope.

• Implement continuous monitoring of AI agents for suspicious activities.

"If organizations using Now Assist's AI agents aren't closely examining their configurations, they're likely already at risk," warned Costello.

Sources

• ServiceNow AI Agents Can Be Tricked Into Acting Against Each Other via Second-Order Prompts, The Hacker News.