Now Assist agent recruitment. The access path.
One poisoned record field let an agent recruit more privileged agents. A low privileged attacker writes the text. A high privileged employee's identity executes it.
The record
Entry point. record field, instructions written into a field a benign agent will read.
The identity in the middle. The triggering employee. Now Assist agents run with the privileges of whoever started the interaction, not of whoever wrote the text they read.
What was reached. records, external email and admin roles, data copied between records, sent to external email, admin roles assigned.
One poisoned record field let an agent recruit more privileged agents.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| record field | Entry | instructions written into a field a benign agent will read |
| benign agent | Step | reads the poisoned data while doing its normal task |
| agent-to-agent discovery | Step | published agents are discoverable and same team by default |
| recruited privileged agents | Step | delegation carries the triggering user's privileges, not the planter's |
| records, external email and admin roles | Reached | data copied between records, sent to external email, admin roles assigned |
Where a breakpoint would have been
Discovery defaults. The injection only escalates because a benign agent can find and delegate to more capable agents on the same team without supervision. Segmenting agent duties and requiring supervised execution for privileged agents closes the path at the delegation step.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the Now Assist agent recruitment incident?
The published path starts at record field, instructions written into a field a benign agent will read.
What did it reach?
The last step in the published path is records, external email and admin roles, data copied between records, sent to external email, admin roles assigned.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.