AppOmni researchers reported in November 2025 that default settings in ServiceNow's Now Assist generative AI platform let one AI agent discover and recruit another, so that a prompt hidden in content an agent reads could get agents to copy and exfiltrate sensitive corporate data, modify records and escalate privileges, even with prompt-injection protection turned on. AppOmni said this was expected behavior under default configuration options, not a bug, and that the actions happen unbeknownst to the victim organization. No victim is named.