abdelfane

3 ms·

1. 1.▲
   by abdelfane 10mo ago

   You're right that at the technical level, it's an unsecured API. But I'd argue the AI context matters for two reasons: 1. The capability itself: The "create data anywhere" permission wasn't a legacy API—it
2. 2.▲
   by abdelfane 10mo ago

   Author here. I spent the last week analyzing this vulnerability from a security architecture perspective. Key insight: This isn't a ServiceNow-specific problem. It's an industry-wide pattern of grafting AI agents onto legacy auth
3. 3.▲
   Analysis of ServiceNow's AI Vulnerability (85% of Fortune 500 Affected)(opena2a.org)

   3 points by abdelfane 10mo ago|4 comments