SERVICENOW BODYSNATCHER FLAW HIGHLIGHTS RISKS OF RUSHED AI INTEGRATIONS

Summary from the TLDR InfoSec newsletter

BodySnatcher is a critical vulnerability in ServiceNow's Now Assist AI Agents and Virtual Agent API that allows unauthenticated attackers to execute agentic workflows as any user by exploiting weak authentication defaults and auto-linking features—potentially creating backdoor admin accounts. ServiceNow patched hosted instances in late October (Now Assist AI Agents 5.1.18/5.2.19+ and Virtual Agent API 3.15.2/4.0.4+), but the underlying misconfigurations may persist in custom code and third-party integrations. Organizations should enforce MFA with proper validation scripts for Virtual Agent API providers, enable AI steward approval in AI Control Tower, and regularly audit and disable unused AI agents.