Agent hijacking & lateral movement: Lessons from the ServiceNow AI vulnerability

Identity Security lessons

If you are in the workflow of building/securing/guardrailing agents, here is my take on the several identity and access control failure patterns surfaced with unusual clarity in the vulnerable way those agents and their credentials/trust were formed: 

Impersonation without authentication

The platform accepted identity assertions based on weak identifiers rather than cryptographic proof. Email addresses functioned as identity tokens, bypassing session validation, MFA, and assurance levels entirely. 

Privilege escalation plus persistence 

Once impersonation succeeded, attackers did not need to exploit additional vulnerabilities. They used legitimate workflows to create new privileged accounts and modify roles, establishing persistence through authorized state changes rather than covert backdoors. 

Business logic and workflow abuse

The exploit path relied on approved automation behaving exactly as designed. Provisioning flows, approvals, and configuration changes executed correctly, just under a false identity. This shifted the attack surface from code defects to trust assumptions embedded in business logic.

Agent-to-agent trust abuse

Agents delegated authority to other agents without revalidating identity or intent. This created a modern confused-deputy scenario where trust propagated transitively across agents, amplifying the impact of a single compromised identity context.

Second-order execution

Low-trust inputs triggered high-privilege actions indirectly through intermediary agents. The attack surface was not prompt or language manipulation, but execution context and delegated authority.

Detection and audit erosion

When the identity layer itself was compromised and attackers kept moving upstream, actions appeared to be legitimate user activity. As a result, traditional identity-based monitoring and behavioral analytics lost their fidelity. Together, these patterns demonstrate that agentic systems erode traditional security layering unless identity controls are enforced continuously, contextually, and at runtime. When identity is treated as an assumption rather than a control, automation becomes an accelerant for compromise rather than a force multiplier for security. 

Conclusion: From misconfiguration to the next APT

This attack flow exposes a systemic failure in the design and execution of AI Agents rather than a single flaw. In the agentic interaction flow, identity was validated once and then assumed indefinitely. Trust propagated across agents and workflows without revalidation. Each decision looked reasonable in isolation, but together they formed an unsafe execution path. These are flow-level vulnerabilities, rooted in how authority moves through long lived, autonomous, and compositional systems.

The blind spot is not code quality, but trust continuity. Organizations must scan for unsafe trust paths, not just misconfigurations. IAM and security teams must assume these mistakes will happen and enforce runtime identity security so abuse is detected and stopped even when design assumptions fail. This is also a call to the attack validation community to model agentic attack paths and trust propagation failures. 

Do not let the speed of AI adoption and the spirit of experimentation leave identity behind. As agentic systems move faster than traditional controls, identity security must expand into new territory: continuous, real time, and context-aware. The organizations that adapt identity to how work actually executes will be the ones who stay ahead of what comes next.

This is not the next generation of attacks. Attack groups are already incorporating scanning, challenge evasion, and exploitation of these faulty design patterns into their APT infrastructure and testing them against large enterprises.