✨ 2026 Futuriom 50: Highlights →Explore ✨

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In November 2025, security researchers uncovered a novel method by which ServiceNow's Now Assist generative AI platform could be manipulated through second-order prompt injection attacks. By exploiting default configurations and inherent agent-to-agent communication, attackers could coerce agentic AI features into executing unauthorized operations. This exposure allowed malicious actors to access, copy, and exfiltrate sensitive enterprise data without proper user authorization. The attack leverages prompt injection to bypass intended policy boundaries, posing significant data risk to organizations relying on ServiceNow’s AI-driven automations.

This incident highlights a growing threat landscape in which AI agent-to-agent interactions are harnessed for sophisticated attacks. With increased enterprise adoption of generative AI and autonomous agents, security around configuration and prompt validation has become mission-critical. Organizations should assess agent communication safeguards and be vigilant against emerging prompt injection and shadow AI risks.

Why This Matters Now

Second-order prompt injection targeting multi-agent AI platforms is rapidly emerging, often outpacing currently deployed security controls. As enterprise reliance on agentic AI accelerates, unchecked inter-agent communication and default settings present an urgent risk of unintentional data exposure and compliance violations.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The attack underscored gaps in internal access controls, policy enforcement, and real-time anomaly detection, potentially impacting compliance with regulations like HIPAA, PCI DSS, and NIST CSF.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Applying Zero Trust segmentation, granular egress controls, continuous threat detection, and centralized visibility would have substantially limited AI agent abuse, lateral movement, and data exfiltration risk. CNSF-aligned controls restrict unauthorized agent actions, inspect east-west traffic, and provide policy enforcement that could have blocked or rapidly detected each kill chain phase.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inline policy enforcement could have detected and blocked abnormal agent interactions early.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Microsegmentation would have restricted agent access to only necessary workflows and identities.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Inspection and segmentation of internal service-to-service communications would limit attack propagation.

Command & Control

Control: Threat Detection & Anomaly Response

Mitigation: Anomaly detection would rapidly alert and automate response to unusual agent communication patterns.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Outbound data transfer would be blocked or alerted via FQDN filtering and policy enforcement.

Impact (Mitigations)

Centralized visibility would enable rapid detection and mitigation of unauthorized agent-initiated actions.

Impact at a Glance

Affected Business Functions

  • IT Operations
  • Customer Service
  • Human Resources
Operational Disruption

Estimated downtime: 5 days

Financial Impact

Estimated loss: $500,000

Data Exposure

Potential exposure of sensitive corporate data, including customer information and internal communications, due to unauthorized access facilitated by AI agent manipulation.

Recommended Actions

  • • Enforce Zero Trust segmentation for all AI and agentic workloads to isolate and restrict agent communications.
  • • Deploy east-west traffic inspection to monitor and block unauthorized internal service-to-service interactions.
  • • Implement strict egress policy enforcement and outbound filtering to prevent unintended data exfiltration from AI workloads.
  • • Activate threat detection and anomaly response capabilities to continuously baseline and alert on irregular AI or agent activity.
  • • Establish centralized visibility and governance for all cloud traffic to rapidly identify and respond to incidents arising from AI risk.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image