ServiceNow AI Agents Security for Now Assist AI Agents, AI Agent Studio and Agentic AI
ServiceNow AI agents built in AI Agent Studio resolve incidents, update records, assign roles, send email and, through the MCP Client and Integration Hub, call systems outside the instance. Since late August 2026 two things changed for the teams running them: ServiceNow published three critical AI Platform vulnerabilities rated 10.0 that self-hosted customers have to patch themselves, and its own new agent security products went on sale, which pushed agent governance onto every platform owner's review list.
Direct answer
ServiceNow AI agents security comes down to four checks. Patch first, because the August 27, 2026 advisory (KB3152242) fixed three AI Platform flaws rated CVSS 10.0 that an unauthenticated user could use, and ServiceNow patched hosted instances while self-hosted customers apply the update themselves. Then split agent teams, because published Now Assist agents are discoverable and grouped into one team by default, which lets a prompt-injected agent recruit a more powerful one. Run every tool that writes records or sends email in supervised mode. And put a gate on the MCP and REST calls that leave the instance, where ServiceNow roles stop applying.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A US insurance carrier runs a ServiceNow agent that triages inbound HR cases and a second agent that manages access requests. Both were published to the default Virtual Agent, so they share a team. A case description contains instructions telling the triage agent to ask a colleague to grant the HR admin role to a contractor account. The triage agent cannot assign roles, but the access agent can, and the case was opened by an HR manager whose privileges the agents run with. The role is granted before anyone looks.
How AgentShield handles it
Keep ServiceNow's controls for what they do well: ACLs evaluated against the invoking user, the dynamic user identity by default, supervised mode on tools that change records, Now Assist Guardian for prompt injection and sensitive topics, and AI Control Tower for inventory. Then gate the calls that leave the instance. When an AI Agent Studio agent uses tools from an external MCP server through the MCP Client, point that server connection at an AgentShield gateway endpoint. Each call is checked against per-tool and per-argument policy, a payment, a vendor change or an outside email waits for a named approver who is not the requester, injected instructions in the inputs are flagged, and every decision is written to an audit trail the agent cannot edit.
The controls
The controls that secure which ServiceNow AI agent tools run, under whose identity, and what leaves the instance.
What ServiceNow AI agents do and which control covers each action
ServiceNow AI agents are LLM-driven agents built in AI Agent Studio and delivered through Now Assist. An agent has instructions and a set of tools: record operations, flows and subflows, scripts, catalog items, Integration Hub spokes and, with the MCP Client application, tools hosted on external MCP servers. Agentic workflows chain several agents toward one goal, and the AiA ReAct engine with its Orchestrator decides which agent handles each step.
Most of what these agents touch lives inside the instance, which is good news. ServiceNow has twenty years of access control on those tables. The security question is which of the invoking user's permissions an agent should use without a person looking first, and what happens to the calls that leave the instance.
| What the agent does | ServiceNow control that applies | What that control does not decide |
|---|---|---|
| Read and update incidents, cases, changes and catalog records | ACLs checked against the invoking user, then the agent identity | Whether this particular update came from a hostile instruction in a record field |
| Assign roles, reset access, create users | Roles of the invoking user or the AI user, supervised mode on the tool | Whether a second person should approve a privilege change |
| Send email or notifications | Email properties, supervised mode, Now Assist Guardian checks | What content is allowed to leave, and to whom |
| Call external MCP servers through the MCP Client | Connection setup, credentials, AI Control Tower visibility | Which arguments a write call may carry on the far side |
| Call REST APIs and spokes through Integration Hub | Connection and credential aliases, spoke roles | Which payments, vendor changes or exports should run |
Read the right-hand column as the scope of each control, not as a list of ServiceNow failures. The platform does identity and record access well. The open questions sit at the moment an agent decides to act.
Patch the August and September 2026 ServiceNow AI Platform advisories first
Before buying anything, confirm your patch level. On August 27, 2026 ServiceNow published three AI Platform vulnerabilities, each rated CVSS 10.0 (critical) by ServiceNow's own security team in the National Vulnerability Database, and on September 24 it added a fourth. All four are reachable by an unauthenticated user "in certain circumstances," in ServiceNow's words.
| CVE | Type, per ServiceNow | Rating | Advisory |
|---|---|---|---|
| CVE-2026-18885 | Code injection, could let an unauthenticated user "execute arbitrary code in the ServiceNow platform" | 10.0 critical | KB3152242, Aug 27, 2026 |
| CVE-2026-18886 | Improper access control, could let an unauthenticated user create or modify instance data, "resulting in privilege escalation" | 10.0 critical | KB3152242, Aug 27, 2026 |
| CVE-2026-74820 | SQL injection, could let an unauthenticated user "execute arbitrary SQL statements" against the instance database | 10.0 critical | KB3152242, Aug 27, 2026 |
| CVE-2026-86858 | Improper access control, could let an unauthenticated user "create, modify, or delete instance data" | 8.7 high | KB3159623, Sep 24, 2026 |
ServiceNow says it "deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers," and that it was not aware of malicious exploitation. If ServiceNow hosts your instance, there is nothing to do but confirm. If you self-host, the update is yours to apply, and no agent security product substitutes for it. These are platform flaws, not agent behavior, and a runtime gate does not sit in front of an unauthenticated request to a vulnerable endpoint.
Also confirm the January 2026 fix. CVE-2025-12420, rated 9.3 by ServiceNow, "could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform." It affected Now Assist AI Agents and the Virtual Agent API, and ServiceNow fixed hosted instances in October 2025 with store app updates for everyone else (KB2587329).
Default agent discovery lets one ServiceNow AI agent recruit another
The most useful research on ServiceNow agent behavior comes from AppOmni, a SaaS security vendor that sells monitoring for it. Its finding is about defaults, and ServiceNow confirmed the behavior is intended and updated its documentation. Three settings line up out of the box:
- The default LLM supports discovery. At the time of AppOmni's write-up, both the Now LLM (the default) and the Azure OpenAI LLM supported agent discovery.
- Agents share a team by default. Agents deployed to the same channel, such as the default Virtual Agent, "are automatically grouped into the same team by default, often without users realizing it."
- Agents are discoverable by default. "Agents are also marked as being discoverable by default when published."
Put together, a harmless agent that reads a record field containing hostile instructions can ask the Orchestrator for a teammate that can do more, such as create records, assign roles or send email. AppOmni adds the detail that matters most for impact: "Now Assist agents run with the privilege of the user who started the interaction," not the privilege of whoever wrote the hostile text into the field. In AppOmni's words, "the possible impact is determined by the capabilities of the tools, which are possessed by the agents within the team."
The fix costs nothing. Split agents into teams by duty, so an agent that only reads cannot reach one that writes. Our page on prompt injection protection covers the detection side, and multi-agent security covers the same delegation problem on other platforms.
Supervised mode, the AI user and the execution override
ServiceNow gives each tool an execution mode. In autonomous mode the tool runs without asking anyone. In supervised mode the agent stops and a person reviews the action before it runs, and ServiceNow positions supervised mode for tools that perform sensitive or critical actions. Identity is set at the agent and workflow level, with two options in ServiceNow's access control documentation:
| Setting | What it does | What to watch |
|---|---|---|
| Dynamic user (default identity) | The agent runs as the person who invoked it, and ACLs are checked against that person | An HR manager's or admin's session lends its full rights to whatever the agent reads |
| AI user | A dedicated user record with fixed roles runs the agent, which can grant rights the invoking user lacks | Elevated roles on a shared identity; keep them narrow and owned by someone |
| Supervised execution mode on a tool | A person reviews the action before it runs | The reviewer is usually the user in the conversation, not a second approver |
| sn_aia.enable_usecase_tool_execution_mode_override | When true, an agent with at least one autonomous tool runs all its tools autonomously | False by default; keep it false and alert if it changes |
ServiceNow also fails closed on conflicts: if the security requirements of the workflow, the agent and the tool disagree, or the invoking user passes some ACLs and not others, the agentic AI does not run. That is the right design. The gap is that supervised mode puts the decision in front of the person already in the chat, and for a privilege change, a refund or an outside email, a US auditor will ask who besides the requester approved it. Our approval gates for AI agents page covers routing that decision to a named approver.
Calls that leave the instance through the MCP Client and Integration Hub
ServiceNow's MCP Client application lets AI agents built on the platform use tools hosted on external MCP servers, and it plugs into AI Agent Studio. Integration Hub spokes and REST steps reach the same kinds of systems: ERP, payments, CRM, identity providers, cloud consoles. Once a call leaves the instance, ServiceNow roles describe who may start the agent, not what the far system lets the call do. The credential on the connection decides that.
| Outbound path | Can a gate sit in front of it | What we recommend |
|---|---|---|
| External MCP servers your team runs, used through the MCP Client | Yes, point the server connection at a gateway endpoint | AgentShield MCP gateway with per-tool, per-argument rules and named approvers |
| Third-party hosted MCP servers | Yes, if you proxy the connection through your own gateway | Same gateway, holding the real credential so the agent never sees it |
| Integration Hub spokes and REST steps | Only where you route the connection through a proxy you control | Keep the spoke, scope the credential tightly, use supervised mode, and rely on dual control in the target system |
| Record operations inside the instance | No, and it should not | ACLs, AI user scoping, team segmentation and supervised mode |
The honest split: inside the instance, ServiceNow is the control plane and should stay that way. Outside it, a call that moves money or changes a vendor or customer record deserves a rule on its arguments and a person who is not the requester. Pair it with the per-tool permissions and AI agent audit trail features so the evidence lives outside the agent's reach.
What ServiceNow and AppOmni already sell for agent security
Two vendors already have strong products here, and for many ServiceNow shops one of them is the better first purchase.
| Product | What it covers | Where it is strongest | Where it stops |
|---|---|---|---|
| Now Assist Guardian | Offensive content, prompt injection and sensitive topic detection on Now Assist | Built in, no extra integration | Detection on model traffic, not rules on what an outside system receives |
| AI Control Tower | Inventory and governance of AI agents and models, agent activity tracking | One register for every agent on the platform | Tells you what exists and what ran |
| AI Agent Access Security and Non-Human Identity Remediation | Access for AI agents across platforms; revokes permissions and rotates keys, per ServiceNow's August 2026 launch | Identity hygiene for agents and service accounts | Governs standing access, not each proposed action |
| AppOmni AgentGuard | Real-time analysis of Now Assist agent actions and conversations, posture checks | Purpose-built for ServiceNow, finds misconfigured teams and overrides | Focused on the SaaS platform side rather than outbound call arguments |
| AgentShield | Per-tool, per-argument policy on MCP calls, named approvers, injection checks, audit trail | Agents that write to money, vendor or customer systems outside the instance | Does not see record operations inside the instance |
If your agents only work inside ServiceNow, AppOmni or ServiceNow's own stack fits better than we do. We sell the gate on outbound calls, and that is the only place we would argue for ourselves.
ServiceNow AI agents security checklist for US platform teams
- Confirm the patch level. Self-hosted instances need the KB3152242 and KB3159623 updates, and Now Assist AI Agents needs the KB2587329 store app versions.
- Split agent teams by duty. Do not let read-only agents share a team with agents that create records, assign roles or send email.
- Review discoverability. Turn it off for agents that never need to be called by another agent.
- Set supervised mode on write tools. Record changes, role assignments, email and any outbound call start supervised.
- Keep the override off. Leave sn_aia.enable_usecase_tool_execution_mode_override at false and alert on any change.
- Scope AI users narrowly. Prefer the dynamic user, and give each AI user an owner and the smallest role set that works.
- Turn on Now Assist Guardian. Use it for prompt injection and sensitive topic detection on agent conversations.
- Gate outbound writes. Route MCP connections that reach finance, vendor or customer systems through a gateway with per-argument rules and an approver who is not the requester.
The platform neutral version of this list is our page on AI agent security best practices. If ServiceNow agents sit next to Microsoft or Oracle agents in your estate, the Copilot Studio security and Oracle AI Agent Studio security pages cover those platforms.
When to buy nothing, use ServiceNow controls, or add AgentShield
| Your situation | Recommendation | Why |
|---|---|---|
| Self-hosted instance behind on patches | Buy nothing yet. Apply KB3152242 and KB3159623 | Unauthenticated platform flaws come before agent policy |
| Agents summarize, triage and draft, no write tools | Buy nothing. Teams, discoverability and Guardian | There is no consequential action to gate |
| Agents change records only inside the instance | Use ServiceNow controls, consider AppOmni or AI Control Tower | ACLs, supervised mode and platform monitoring cover the path |
| Many agents, nobody knows which exist | AI Control Tower or a SaaS posture tool | Inventory before policy |
| Agents call MCP servers that write to payments, vendors or customers | Add AgentShield as the MCP gateway behind those connections | Rules on arguments, a second approver and evidence outside the instance |
| Agents across ServiceNow, Microsoft and AWS share MCP servers | Add AgentShield as one policy point for those servers | One rule set and one audit trail instead of one per platform |
Four of six rows end without a purchase from us. If you are comparing options, the buyer guide for ServiceNow AI agents sets six of them side by side, and the MCP server security page covers the server side of the gate.
FAQ
Common questions about servicenow ai agents security.
What are ServiceNow AI agents?
ServiceNow AI agents are LLM-driven agents built in AI Agent Studio and delivered through Now Assist. Each agent has instructions and tools such as record operations, flows, scripts, Integration Hub spokes and external MCP server tools. Agentic workflows chain several agents toward one goal, and an Orchestrator picks which agent handles each step.
Are ServiceNow AI agents secure?
They inherit strong platform controls: ACLs checked against the invoking user, a dynamic user identity by default, supervised mode per tool, and Now Assist Guardian for prompt injection. The open risks are default agent discovery within shared teams, privileged sessions lending rights to agents, unpatched self-hosted instances, and outbound calls ServiceNow roles do not govern.
Which ServiceNow AI Platform vulnerabilities do I need to patch?
Self-hosted customers should apply KB3152242, which fixes CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820, all rated CVSS 10.0, and KB3159623 for CVE-2026-86858, rated 8.7. ServiceNow says it deployed the updates to hosted instances and was not aware of malicious exploitation. Also confirm the KB2587329 fix for CVE-2025-12420.
What is supervised mode in ServiceNow AI Agent Studio?
Supervised mode is an execution setting on an AI agent tool. When a tool runs in supervised mode, the agent pauses and a person reviews the action before it runs. In autonomous mode the tool runs without approval. ServiceNow recommends supervised mode for tools that perform sensitive or critical actions, such as record changes and email.
Can one ServiceNow AI agent call another?
Yes. Now Assist agents on the same team can discover and invoke each other through the Orchestrator, and published agents are discoverable and grouped into one team per channel by default. That is intended behavior, but it lets a prompt-injected agent recruit a more capable teammate. Split agents into teams by duty to limit it.
What identity do ServiceNow AI agents run as?
By default, the dynamic user, which means the agent runs as the person who invoked it and ACLs are checked against that person. You can instead assign an AI user, a dedicated user record with fixed roles that can give the agent rights the invoking user lacks. If the security requirements conflict, the agentic AI does not run.
Does ServiceNow sell its own AI agent security?
Yes. Now Assist Guardian detects prompt injection and sensitive topics, AI Control Tower inventories and governs agents, and in August 2026 ServiceNow launched AI Agent Access Security and Non-Human Identity Remediation inside AI Control Tower. Third parties such as AppOmni also sell monitoring built specifically for Now Assist agents.
Does AgentShield work with ServiceNow AI agents?
Yes, for calls that leave the instance through external MCP servers. Point the MCP Client connection at an AgentShield gateway endpoint and keep the real credential in the gateway. Each call is checked against per-tool and per-argument policy, and risky calls wait for a named approver. Record operations inside ServiceNow stay with ServiceNow controls.
More use cases