ServiceNow AI Platform pre-auth sandbox-escape RCE (CVE-2026-6875)
Disclosed vulnerability13 Jul 2026Distinct from the library's ServiceNow Now Assist agent-discovery case (second-order agent-to-agent injection): this is a formally-tracked, reportedly actively-exploited pre-auth RCE in mainstream enterprise SaaS AI, showing that unsafe dynamic evaluation of attacker text as code turns an AI product into a high-value RCE target. CVSS, dates and exploitation are per the advisory and reporting.
Risks it illustrates
Practise the risk class — related scenarios
Interactive simulations of the risk class this case illustrates (not a re-enactment of this specific event).
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A support email hides instructions — and the assistant obeys them
A text-to-SQL agent runs the model's output straight at the database
A speed optimisation becomes a cross-tenant listening device
Compromise the pipeline that builds agents, and every new worker is born malicious
Two doors to the same secret: reconstruct the model through its API, or just walk off with the weight file
An auto-approving coding agent reads a poisoned page — and executes code it never should have
A fake Sentry error report hijacks a developer's coding agent into running a shell command
Every command is harmless on its own — the sequence is the exploit
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A cost-saving open-weights swap quietly ships a model with its safety surgically removed
A screenshot that's harmless at full size becomes an order once the system shrinks it
A capable third-party model that behaves perfectly — until it sees the trigger
An attacker captures the agent's bearer token — and inherits its authority
A trusted MCP email tool quietly BCCs every message to an attacker
A forged peer registers on the agent directory — and the planner enlists it
An inbox summary quietly ships a secret to an attacker's server