How to use this reference
Review permitted collaborators, execution identities and sensitive-action approvals together. Restrict team composition and delegated capabilities to the task, apply least privilege, and require approval for sensitive actions. ServiceNow's current documentation distinguishes discovery/invocation access from the agent's data-access identity and describes supervised execution. Editorial lesson: evaluate reachable authority across the collaboration, rather than only the first agent's tool list.
Before reading
- AI content-versus-instruction trust boundaries
- Role-based access, execution identities and delegated permissions
Context and limits
- The reported setup processed lower-trust record content under a privileged agent context with discoverable collaborators and relevant autonomous capabilities; this is configuration-dependent.
- AppOmni says ServiceNow treated the behavior as intended and clarified on-platform documentation. The reviewed evidence establishes no vulnerability patch, CVE or individual award for this case.
- Reported effects are researcher demonstrations, not evidence of production exploitation or a prevalence estimate.
- The supporting ServiceNow pages display Brazil release and September 10, 2026 updates. They document the current configuration model, not the November 2025 demonstration, its defaults or a historical fix.
- The research-paper taxonomy includes first-party research articles and does not imply academic peer review. This educational record grants no testing authorization.
Sources and provenance
- When AI Turns on Its Team: Exploiting Agent-to-Agent Discovery via Prompt Injection AppOmni AO Labs · reviewed 2026-10-06
- Define security controls for an AI agent ServiceNow · reviewed 2026-10-06
- Use an AI agent action ServiceNow · reviewed 2026-10-06
Record reviewed 2026-10-06. Snapshot cb017eaea66e. Open the complete JSON contract.