ServiceNow disclosed a now-patched critical flaw in its AI Platform, CVE-2025-12420, rated 9.3 out of 10 and named BodySnatcher by AppOmni, which found it. ServiceNow said it could let an unauthenticated user impersonate another user and act as them; AppOmni said an attacker needed only an email address, could bypass multi-factor authentication and single sign-on, and could run an AI agent as an administrator. The fix covers Now Assist AI Agents and the Virtual Agent API; ServiceNow patched most hosted instances on 30 October 2025. The Hacker News reported no evidence of exploitation in the wild.