BodySnatcher. The access path.
One shared secret shipped to every instance let anyone drive ServiceNow AI agents as any user. MFA and SSO were both in the picture, and neither was in the path.
The record
Entry point. Virtual Agent API endpoint, reachable over the network without authentication.
The identity in the middle. Two broken machine identities: a hardcoded integration secret named servicenowexternalagent, identical across all instances, and a Basic account linking method that bound an external caller to a user on an email address alone.
What was reached. administrator accounts, the published proof of concept created new admins and assigned privileged roles.
One shared secret shipped to every instance let anyone drive ServiceNow AI agents as any user.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| Virtual Agent API endpoint | Entry | reachable over the network without authentication |
| hardcoded shared secret | Step | the same value on every ServiceNow instance |
| email only account linking | Step | an email address is enough to be linked to that user, with no MFA and no SSO |
| Now Assist AI Agents | Step | privileged agentic workflows driven as the impersonated user |
| administrator accounts | Reached | the published proof of concept created new admins and assigned privileged roles |
Where a breakpoint would have been
The shared secret. It authenticates the integration, not the person, and a secret that is identical everywhere cannot be rotated by one customer. Everything after it, the agentic workflows included, is downstream of a credential that was never really a credential.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the BodySnatcher incident?
The published path starts at Virtual Agent API endpoint, reachable over the network without authentication.
What did it reach?
The last step in the published path is administrator accounts, the published proof of concept created new admins and assigned privileged roles.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.