Exploitable ServiceNow and Microsoft AI agents expose growing security risks

Researchers discovered exploitable agentic AI technologies from ServiceNow and Microsoft, highlighting that securing agentic AI is already proving extremely challenging and that cybersecurity teams should adopt a least-privilege posture for AI agents. AppOmni Labs disclosed a ServiceNow vulnerability called "BodySnatcher" that could let an unauthenticated attacker, with only a target's email address, impersonate an administrator and execute an AI agent to override security controls and create backdoor accounts.

ServiceNow says it issued a security update and recommends customers apply the update if they have not; its cloud SaaS instances received the fix automatically. In a separate case, Zenity Labs reported that Copilot Studio's "Connected Agents" feature can allow other agents to connect to and leverage privileged agents, including those with email or sensitive-data access.

servicenow, bodysnatcher, appomni labs, unauthenticated attacker, administrator impersonation, ai agent, least-privilege posture, copilot studio, zenity labs, connected agents