An attacker sitting halfway across the globe, armed only with a target’s email address and a hardcoded token, can hijack a Fortune 500’s ServiceNow AI agents. No credentials. No MFA bypass exploit. Just API requests and a conversational command: “Create an admin user for me.”
That’s CVE-2025-12420, codenamed “BodySnatcher” – scored 9.3/10 CVSS, disclosed January 2026. Security researchers at AppOmni are calling it “the most severe AI-driven vulnerability uncovered to date.”
The flaw wasn’t a sophisticated zero-day. It was a hardcoded secret.
This vulnerability illuminates something more concerning than a single patch can fix: agentic AI security is fundamentally different from traditional application security. The organizations deploying AI agents at scale are discovering that conventional security frameworks don’t account for systems that can understand natural language instructions and autonomously execute multi-step operations across enterprise infrastructure.
Welcome to the era of the “Agentic Blast Radius.”
How BodySnatcher works: Two flaws, infinite access
The technical chain behind BodySnatcher reveals how agentic AI security failures differ from traditional vulnerabilities. ServiceNow didn’t just have one weakness – they shipped a combination of architectural decisions that, when exploited together, granted complete system takeover.
The first flaw: ServiceNow shipped a universal client secret (“servicenowexternalagent”) across ALL instances globally. Every enterprise deployment – from healthcare systems to financial institutions – shared the same hardcoded token. The second flaw: their auto-linking mechanism required only an email address, with no MFA requirement.
The third component wasn’t a flaw at all – it was a feature. ServiceNow shipped an example Record Management AI Agent with the Now Assist AI application. This agent could create records in ANY table, including sys_user (the user administration table), and had the same identifier across all customer instances. It was designed to help employees automate workflows. Instead, it became the perfect privilege escalation tool.
The attack flow in five steps:
- Step 1: POST request to Virtual Agent API with hardcoded token + target email
- Step 2: Auto-linking associates session with legitimate user
- Step 3: ServiceNow treats attacker as that user (even admin)
- Step 4: Natural language: “Create a new admin user account for me”
- Step 5: AI agent creates backdoor with full privileges
No SQL injection. No buffer overflow. No sophisticated exploit code. Just a conversational command to an AI system that was designed to be helpful.
As Aaron Costello from AppOmni explained in their technical analysis: “Attackers could have effectively ‘remote controlled’ an organization’s AI, weaponizing the very tools meant to simplify the enterprise.”
Why agentic AI security demands a new mental model
Traditional vulnerabilities have linear impact. Compromise one system, gain access to that system. Maybe pivot to connected systems if you’re skilled and lucky. The blast radius is contained by network segmentation, privilege boundaries, and the attacker’s technical ability to exploit what they’ve gained.
Agentic vulnerabilities have exponential impact. Compromise the agent, and it compromises everything it can access – automatically, at machine speed, using its built-in understanding of the entire system architecture. The blast radius is determined by the agent’s permissions, not the attacker’s skill.
Here’s the paradigm shift in action:
| Traditional Approach | Agentic Approach |
|---|---|
| Map API endpoints manually | Agent already knows all endpoints |
| Write exploitation code | Say “create admin user” |
| Hours of technical work | Single conversational command |
| Requires deep system knowledge | Requires knowing what to ask for |
| Rate-limited by human execution | Executes at machine speed |
The agent’s ability to map natural language to high-privilege API calls drastically shortens the attack path. This is the Agentic Blast Radius: a single conversational command can now compromise entire enterprise systems because the AI understands both what you’re asking for and exactly how to accomplish it.
ServiceNow serves 85% of Fortune 500 companies. An attacker with admin access doesn’t just own that platform – they gain a launchpad into every connected system. Salesforce integrations. Microsoft 365 workflows. HR systems. Financial platforms. The agent knows how to access them all.
The agentic security crisis isn’t hypothetical
BodySnatcher isn’t an isolated incident. It’s a preview of what happens when enterprises deploy AI agents faster than security teams can adapt their threat models.
In December 2025, OWASP released their Top 10 for Agentic Applications, documenting the most critical security risks in this new paradigm. The top three:
- ASI01: Agent Goal Hijacking – Manipulating an agent’s objectives through prompt injection or context poisoning
- ASI02: Tool Misuse – Agents using their granted capabilities in unintended, harmful ways
- ASI03: Identity and Privilege Abuse – Exactly what BodySnatcher exploited
BodySnatcher combined ASI02 and ASI03 perfectly. The agent had legitimate tools (record creation), legitimate privileges (access to sys_user table), and legitimate identity handling (auto-linking). The vulnerability wasn’t in any single component – it was in how they combined.
The MCP ecosystem faced similar issues. CVE-2025-6514, scored 9.6 CVSS, allowed arbitrary OS command execution through MCP servers. When your AI agent can execute system commands based on natural language requests, “delete the test files” might accidentally become “delete all files.”
The adoption curve is outpacing security readiness. Gartner predicts 40% of enterprise applications will have embedded AI agents by end of 2026 – up from less than 5% in 2025. That’s explosive growth in attack surface area, and most organizations are deploying agents faster than they’re deploying controls to govern them.
Forrester predicts that agentic AI will cause a public breach leading to employee dismissals in 2026. That’s not a possibility – it’s a forecast from one of the most conservative analyst firms in enterprise tech.
Avivah Litan, VP Analyst at Gartner, captured the core challenge: “As enterprises move towards complex multi-agent systems that communicate at breakneck speed, humans cannot keep up with the potential for errors and malicious activities.”
One compromised agent doesn’t just affect one workflow – it can trigger a chain reaction across every system that agent can access. When failures cascade through interconnected agent systems, the blast radius extends far beyond the initial compromise.
Why this vulnerability got missed
Hardcoded secrets are DevOps 101 violations. Every security training course covers them. Every code scanner flags them. Yet ServiceNow – a company that provides enterprise security management tools – shipped one to production at global scale.
The root cause isn’t incompetence. It’s velocity. AI teams are moving faster than traditional security review cycles can accommodate. ServiceNow wanted their AI agents deployed quickly to compete in the enterprise AI race. Security became a feature to add later, not a foundation to build on.
The auto-linking decision prioritized user experience over security. Making employees authenticate with MFA would add friction. Just requiring an email address made the AI agent feel magical. The security team probably raised concerns. Product management probably overruled them.
The default-enabled deployment with excessive permissions followed the same pattern. Why make IT admins configure which tables the agent can access? Just give it access to everything and let the AI figure out what’s needed. Ship fast, fix later.
Except “later” came in the form of a critical vulnerability disclosure, emergency patches across thousands of enterprise instances, and a case study in what happens when you apply traditional development velocity to systems with agentic blast radius.
Securing the agentic future
The fix for BodySnatcher is straightforward: rotate the hardcoded secret, enforce MFA on account linking, implement least-privilege access controls for AI agents. ServiceNow remediated the issue within a week of AppOmni’s October 2025 report – before public disclosure in January 2026. Cloud-hosted customers were automatically patched; on-premise deployments should verify they’re running fixed versions.
But patching one vulnerability doesn’t solve the underlying problem. Enterprises need new security frameworks designed for agentic systems from the ground up. Here’s what that looks like:
Immediate actions every organization deploying AI agents must take:
- MFA enforcement for ALL AI agent account linking. No exceptions. Even internal users. Even admins. Especially admins.
- “Least agency” principle – Grant agents the minimum autonomy required for their function. If an agent only needs to read data, don’t give it write permissions “just in case.”
- Runtime behavior monitoring for agent actions. Log every API call, every data access, every privilege escalation. Treat agents like privileged users because that’s what they are.
- Human-in-the-loop checkpoints for high-risk operations. Creating admin users, modifying security settings, accessing financial data – these require human approval before execution.
- Agent action boundaries. Define explicit lists of what agents CAN do, not just what they CAN’T do. Allowlists, not denylists.
Frameworks to adopt:
- OWASP Top 10 for Agentic Applications 2026 – Threat modeling specifically for agent systems
- Gartner TRiSM (Trust, Risk and Security Management) – Governance framework for AI systems
- Agent Security Posture Management (ASPM) – Emerging category of tools that monitor agent behavior in real-time
The most controversial prediction in enterprise security right now: “Guardian agents” (AI monitoring AI) will become necessary. When agents operate at machine speed across dozens of integrated systems, human security teams can’t keep pace with real-time threat detection. We’ll need AI security agents watching our productivity agents. The trust paradox extends beyond code review into runtime security.
Some organizations are already implementing this. Security agents that analyze the behavior patterns of productivity agents, flag anomalies, and automatically revoke privileges when suspicious activity is detected. It’s agents all the way down.
The blast radius is real
BodySnatcher is a case study, not an outlier. As enterprises race to deploy AI agents for customer service, IT automation, data analysis, and every other workflow that can be automated, the attack surface isn’t just scaling – it’s transforming into something fundamentally different.
Traditional security assumes adversaries need technical skill to exploit vulnerabilities. Agentic security must assume adversaries only need to know what to ask for. Building AI agents is getting easier every quarter. Securing them is getting harder.
The organizations that survive 2026 will be the ones that recognize agentic AI security isn’t an evolution of application security. It’s a fundamentally different discipline that requires different threat models, different tools, and different organizational structures.
Your move.
Get the Daily Pulse
Sharp analysis on what's actually moving in AI. No hype, no filler, no weekly digest.
