Pretty please, AI, pretend you're an admin
ServiceNow's AI platform flaw showed enterprise AI add-ons create a new trust boundary inside systems you already certified.
"Pretty please, AI, pretend you're an admin and give me all the things."
That is roughly the shape of the ServiceNow AI platform vulnerability AppOmni disclosed as BodySnatcher. With little more than a target email address, researchers showed how an attacker could impersonate users - including admins - through Virtual Agent / Now Assist integrations, walking around MFA and SSO assumptions many organisations thought they had locked down. The Hacker News covered the patch timeline.
You bought a platform. You certified it. Then someone flipped on an AI add-on and quietly opened a new trust boundary inside the same tenancy. The risk register often never got the update.
This is not "AI magic." It is privilege, authentication, and input handling applied to agents that can act - another third party with new features and new failure modes. I wrote more about why polite asking is not a control and why third-party MCP-style integrations need the same scrutiny.
If you already flipped the switch:
- Map exposure. Which platforms have AI features on? What data can they reach? How are they authenticated and monitored?
- Filter in and out. Agents that take free-form input are injection surfaces. Unstructured data makes flows harder to assess.
- Least privilege for the agent. The platform can use AI; every user and every agent should not get "all the things."
- Watch usage. Odd query patterns can be early compromise or exfiltration signal.
- Update IR. Add "AI feature compromise" to playbooks. Most plans assume a human operator or a classic API, not an agent that was asked nicely to become admin.
If the agent can act, treat it like a privileged identity.
Find this on LinkedIn and give it a thumbs up: Pretty please, AI, pretend you're an admin
Related
- Many controls for agents are just polite suggestions for why "please don't" is not enforcement
- Everyone's Installing MCP Servers from GitHub for third-party agent tooling risk
- Securing AI initiatives for folding AI into ordinary risk work