Disclosed vulnerability
BodySnatcher: unauthenticated impersonation of any ServiceNow user through Now Assist AI agent linking
AIR-2025-0173 AIR record · 2025-11-servicenow-bodysnatcher
From the supporting source
A Virtual Agent integration flaw...allowed unauthenticated attackers to impersonate any ServiceNow user using only an email address, bypassing MFA and SSO.appomni.com
The record
Disclosed
2025-11-05
Vendor
ServiceNow
Product
ServiceNow Now Assist AI Agents / Virtual Agent API
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — a hard-coded static secret allowed unauthenticated agent linking
Attack surface
Enterprise assistant
Autonomy level
Semi-autonomous
Initial vector
Authentication bypass static secret
Impact type
Account takeover, Privilege escalation, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ServiceNow instances running affected Now Assist AI Agents and Virtual Agent API versions
Capability abused
Defense & remediation
Recorded defense
MFA and SSO on the ServiceNow instance
Guardrail kinds
Authentication
Guardrail outcome
Silent
Fix shipped
ServiceNow remediated hosted instances 2025-10-30; fixed versions Now Assist AI Agents 5.1.18 / 5.2.19 and Virtual Agent API 3.15.2 / 4.0.4
Taxonomy & references
Curator notes
AppOmni Labs. Reported to ServiceNow 2025-10-23, remediated 2025-10-30. Root cause: AI agent providers shipped with an identical hardcoded secret across every ServiceNow instance, plus auto-linking logic that trusted a supplied email address. Reported CVSS 9.3. Not a prompt-injection bug; it is an agent-identity/authentication failure in an agent platform, which is why it belongs in this corpus. ServiceNow said it had no evidence of pre-fix exploitation. date_disclosed is the public-advisory window; the exact publication day was not verified from the AppOmni page.
Supporting sources
Cite as
Enkrypt AI. "BodySnatcher: unauthenticated impersonation of any ServiceNow user through Now Assist AI agent linking". AIR, AIR-2025-0173. https://agentincident.vercel.app/i/AIR-2025-0173/ (accessed 2026-10-19).