'Most Severe AI Vulnerability to Date' Hits ServiceNow

ServiceNow's Virtual Agent and Now Assist contained authentication weaknesses—a universal third‑party API credential and email-only identity verification—that allowed an attacker with minimal information to impersonate users and weaponize AI agents to create admin accounts, enabling full platform takeover and potentially broad lateral movement across integrated systems; AppOmni reported the issue and ServiceNow remediated it by rotating credentials and removing the exploited AI agent.