The reported threat involves second order prompt injection attacks on ServiceNow's Now Assist, an AI-driven IT service management assistant. Unlike direct prompt injections where malicious input immediately influences AI behavior, second order injections embed malicious payloads in seemingly innocuous inputs that are stored and later incorporated into AI prompts during subsequent interactions. This delayed activation can bypass initial input sanitization and exploit the AI's contextual understanding to execute unauthorized commands, manipulate responses, or exfiltrate sensitive information. The attack leverages the AI's reliance on dynamic prompt construction, where stored user data or system-generated content is reused in prompts without adequate filtering. While no specific vulnerable versions or patches are identified, the threat highlights a novel attack vector against AI assistants integrated into enterprise platforms. The medium severity rating reflects moderate impact potential, considering the attack requires crafted inputs and may not lead to immediate system compromise but can undermine data confidentiality and integrity over time. The lack of known exploits suggests this is an emerging issue requiring proactive attention. The source of information is a recent Reddit NetSec discussion linking to an AppOmni research article, indicating early-stage community awareness and analysis.

For European organizations, the impact of second order prompt injection attacks on ServiceNow Now Assist can be significant, especially for entities relying heavily on automated IT service management workflows. Confidentiality risks arise if the AI assistant inadvertently reveals sensitive information embedded in prompts or manipulated responses. Integrity can be compromised if attackers influence AI-driven decisions or commands, potentially disrupting service operations or causing erroneous ticket handling. Availability impact is less direct but could occur if the AI assistant's behavior leads to operational inefficiencies or triggers automated workflows that degrade service performance. Given ServiceNow's widespread adoption in sectors such as finance, healthcare, and government across Europe, the threat could affect critical infrastructure and sensitive data processing. The attack complexity and requirement for crafted inputs limit broad exploitation but do not eliminate targeted attacks against high-value organizations. The absence of known exploits currently reduces immediate risk but underscores the need for vigilance as AI assistant usage grows.

To mitigate second order prompt injection risks in ServiceNow Now Assist, organizations should implement multi-layered defenses beyond generic advice. First, enforce strict input validation and sanitization on all user inputs stored for later AI prompt construction, including escaping or removing potentially malicious tokens. Second, audit and monitor AI assistant outputs for anomalous or unexpected responses that may indicate prompt manipulation. Third, limit the scope of AI assistant permissions to the minimum necessary, preventing execution of critical commands or access to sensitive data without additional verification. Fourth, implement logging and alerting on unusual AI interactions or prompt content changes to detect early signs of exploitation. Fifth, collaborate with ServiceNow to stay informed about patches or configuration recommendations addressing prompt injection vulnerabilities. Finally, conduct regular security training for administrators and users on the risks of AI prompt manipulation and safe data handling practices within ITSM platforms.