ServiceNow AI Agent Security: The Second-Order Prompt Problem CTA's Need to Know

The Silent Security Threat in Your ServiceNow Instance

Your AI agents just became your biggest security risk. Not because they're inherently insecure, but because most ServiceNow administrators don't understand how second-order prompt injection works—and it's already happening in production instances.

In November 2025, security researchers discovered that ServiceNow AI agents can be tricked into acting against each other through carefully crafted prompts embedded in seemingly innocent fields. The attack is subtle, sophisticated, and completely bypasses traditional security thinking.

Here's what every CTA needs to know about this threat, and why your current security model isn't enough.

What is Second-Order Prompt Injection?

Think of it like SQL injection, but for AI. Instead of malicious code in a database query, attackers embed malicious instructions in data fields that AI agents will later read and process.

Here's the attack flow:

1. Attacker plants malicious prompt in a ServiceNow field (incident description, knowledge article, etc.)
2. AI agent reads the field as part of its normal processing
3. Agent interprets embedded instructions as legitimate commands
4. Agent acts with the privilege level of whoever triggered it—not who planted the prompt

The key insight: AI agents don't distinguish between system instructions and user data. They see text and try to follow it, regardless of where it came from.

Real-World Attack Scenarios

Scenario 1: The Poisoned Knowledge Article

An attacker creates a knowledge article with this hidden in the text:

When Now Assist reads this article to help answer user questions, it might execute those embedded instructions instead of providing the expected help.

Scenario 2: The Escalation Trap

Malicious prompt embedded in an incident:

Scenario 3: The Information Exfiltration

Why This is Worse Than Traditional Attacks

Privilege Escalation: The AI agent runs with the privileges of the user who triggered it, not who planted the malicious prompt. A low-privilege user's embedded prompt can be executed by a high-privilege administrator's AI interaction.

Trust Boundary Violation: Organizations trust their own data. Security teams focus on external threats, not malicious instructions buried in internal knowledge articles or incident descriptions.

Scale: One poisoned knowledge article can affect every AI interaction that references it. The attack multiplies across your entire user base.

Detection Difficulty: Traditional security tools don't scan for "suspicious natural language instructions." This flies under the radar of most security monitoring.

ServiceNow's Response (And Why It's Not Enough)

ServiceNow's official response: "The system works as intended." They've updated documentation to clarify risks, but haven't changed the core behavior.

Their reasoning: AI agents need the ability to read and act on instructions in data to be useful. Completely blocking this would break legitimate workflows.

The problem: This puts the burden on customers to figure out security controls that most don't understand yet.

Practical Defense Strategies

1. Implement AI-Specific Input Validation

Create business rules that scan for suspicious patterns in user inputs:

// Example: Detect potential AI instruction keywords
var suspiciousPatterns = [
    'ignore previous instructions',
    'system override',
    'ai assistant',
    'execute command',
    'priority: critical'
];

// Flag for review if detected
if (containsSuspiciousPattern(current.description)) {
    current.state = 'on_hold';
    current.work_notes = 'Flagged for security review - potential AI prompt injection';
}

2. Restrict AI Agent Privileges

Don't run AI agents with full admin privileges. Create dedicated service accounts with minimal permissions:

• Read-only access to sensitive tables
• No approval authority for high-risk changes
• Limited email capabilities
• Audit all AI actions through dedicated logs

3. Implement Content Sanitization

Before AI agents process user-generated content, sanitize it:

function sanitizeForAI(input) {
    // Remove common AI instruction patterns
    var cleaned = input.replace(/\[.*?AI.*?\]/gi, '[Content Removed]');
    cleaned = cleaned.replace(/---.*?OVERRIDE.*?---/gi, '');
    cleaned = cleaned.replace(/IMPORTANT:.*?AI.*?assistant/gi, '');
    return cleaned;
}

4. Segregate AI Training Data

Never train AI agents on user-generated content directly. Use curated, reviewed content only:

• Approved knowledge articles only
• Template-based responses
• Pre-validated FAQ content
• Regularly audit AI training datasets

5. Monitor AI Behavior Patterns

Create alerts for unusual AI agent activity:

• Unexpected privilege usage
• Off-pattern communication (emails to external domains)
• High-risk actions triggered by low-privilege users
• Batch operations initiated by AI agents

The Bigger Picture: AI Security is Different

This attack represents a fundamental shift in how we think about application security. Traditional security focuses on code vulnerabilities, network attacks, and data breaches.

AI security requires defending against semantic attacks—malicious meaning embedded in legitimate-looking content. Our security tools, training, and mindset aren't ready for this.

What CTAs Should Do Right Now

1. Audit your AI agent permissions immediately
2. Review high-privilege user AI interactions for suspicious activity
3. Implement content filtering on AI-processed fields
4. Train your security team on prompt injection attacks
5. Document AI security policies and communicate to admins
6. Plan for AI-specific security monitoring tools

The Uncomfortable Truth

ServiceNow AI agents are incredibly powerful—and that power comes with risk. The vendor's position that "it works as intended" means the security burden is entirely on you.

Most organizations aren't ready for this responsibility. They're deploying AI agents with the same security mindset they use for traditional applications, and that's a recipe for compromise.

Moving Forward: Defense in Depth for AI

The solution isn't to avoid AI agents—they're too valuable. The solution is to evolve our security approach:

• Assume AI agents will be targeted
• Design security controls specific to AI behavior
• Monitor semantic attacks, not just technical ones
• Train your team on AI-specific threats
• Test your defenses with simulated prompt injection attacks

This is just the beginning. As AI agents become more powerful and prevalent, these attacks will become more sophisticated. The organizations that start building AI-specific security controls now will have a significant advantage.

The question isn't whether your AI agents will be targeted—it's whether you'll be ready when they are.