Reviewing ServiceNow AI Agents — the lesson from a hardcoded shared secret

Agents execute through the Virtual Agent API and Now Assist AI Agent providers, grounded by the Context Engine's CMDB and policy awareness. The platform's bet is that this context grounding, plus governance controls, makes autonomous execution safe enough to remove Tier 1 human review for routine work.

The practical attack: send a crafted request using the shared token, auto-link to an admin account via email, invoke the Record Management AI Agent to create a new admin user, confirm the agent's supervised tool-use prompt via a follow-up request, then reset that backdoor account's password for full platform access. Remediation for on-premise customers: upgrade to 5.1.18/5.2.19 (agents) or 3.15.2/4.0.4 (API); cloud customers required no action.

None of the three steps in the chain is exotic. A hardcoded credential shared across every deployment of a product is a class of mistake that predates AI agents by decades — what makes it worth a dedicated section here is what it unlocks once the thing being authenticated is an agent with tool-execution privileges, not a read-only API. The same bypass against a conventional integration would expose data. Against an AI agent with a “create user” tool, it exposes the entire platform.

“Supervised tool confirmation” — a human approving a consequential agent action — is a real control, and it was in the loop here. It didn't stop the attack, because the attacker was already impersonating a legitimate, trusted user by the time confirmation was requested. A confirmation step only protects against what the confirming identity would refuse — it does nothing once the identity itself is compromised upstream.

BodySnatcher wasn't an isolated incident — 2026 was a rough year for the Now Platform's security record more broadly, and a review should treat the platform's patch history as an ongoing signal, not a closed chapter after one CVE. CVE-2026-6875, a sandbox-escape and code-injection flaw in a pre-authentication endpoint (found by Searchlight Cyber and reported in early April 2026), was patched through June 2026 for self-hosted customers — and was then actively exploited in the wild starting mid-July 2026, with attackers using a different exploitation route than the one in the original public proof-of-concept.

Then, on August 27, 2026, ServiceNow disclosed three separate CVSS 10.0 flaws together: CVE-2026-18885, unauthenticated code injection in the GraphQL Composite Data API — the unified cross-table query interface ServiceNow exposes to external systems — requiring zero credentials and zero user interaction to achieve arbitrary code execution; CVE-2026-18886, improper access control letting unauthenticated attackers create or modify instance data beyond intended permissions; and CVE-2026-74820, a SQL injection disclosed as part of the same trio. ServiceNow-hosted instances were patched automatically; self-hosted customers had to patch manually.

Three CVSS 10.0 disclosures in a single announcement, on the heels of an actively-exploited flaw just weeks earlier, is a pattern a review should weigh alongside the specific BodySnatcher chain — not because any one CVE remains open, but because it says something about how much unauthenticated attack surface has been found on this platform in one year alone.

For any ServiceNow AI Agent deployment, a design-time review should be able to answer:

• Is the deployment on a patched version (post CVE-2025-12420), confirmed against the specific version ranges above, not just “recently updated”?
• Does account-linking for any external AI agent provider enforce MFA, or does it accept an identifier like email alone?
• Which internal topics can invoke AI agent execution directly, bypassing the normal deployment/approval path — and is that list reviewed, not just the agents themselves?
• Where “supervised tool confirmation” is the control of record for a consequential action, what upstream identity check does that confirmation actually rely on?
• Is the instance patched past the August 27, 2026 trio (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) and the actively-exploited CVE-2026-6875?
• For self-hosted instances specifically, is there a process ensuring ServiceNow security patches are applied promptly, given cloud instances patch automatically but self-hosted ones don't?