ServiceNow AI Agents Can Be Tricked Into Acting Against Each Other via Second-Order Prompts

ServiceNow’s Now Assist AI platform can be tricked into acting against itself through second-order prompt injection, leveraging agent-to-agent discovery to copy or exfiltrate data, modify records, or escalate privileges. The researchers note that this is not a bug but an expected outcome given certain default configuration options, where agents can discover and recruit others to collaborate behind the scenes.

The disclosure highlights that a benign agent could recruit a more powerful one to read or change records, with prompts embedded in content it is allowed to access, even when prompt‑injection protections are enabled.

To mitigate these risks, ServiceNow recommends configuring supervised execution mode for privileged agents, disabling the autonomous override property, segmenting agent duties by team, and monitoring AI agents for suspicious behaviour; Now Assist agents run with the privilege of the user who started the interaction unless otherwise configured.

According to AppOmni, “Through second-order prompt injection, an attacker can redirect a benign task … into something far more harmful,” a view echoed by Aaron Costello, chief of SaaS Security Research at AppOmni, who stresses that these defaults are easy to overlook and require tightened controls. 19 November 2025