AI Agents in SaaS: The Unmanaged Identity Crisis and the New Frontier of Data Exposure + Video

By /

Listen to this Post

Featured Image

Introduction:

The modern enterprise has quietly deployed an autonomous workforce that operates 24/7, inherits human-level privileges, and moves data across siloed applications at machine speed—all without ever passing through a second factor of authentication. As AI agents proliferate across platforms like ServiceNow, Salesforce, and Microsoft 365, they introduce security challenges that traditional identity and access management (IAM), cloud security posture management (CSPM), and data loss prevention (DLP) tools were never designed to address. This article examines how agentic AI expands the SaaS attack surface, explores real-world vulnerabilities like the ServiceNow BodySnatcher flaw, and provides actionable steps for security teams to identify, protect, detect, and respond to AI-driven data exposure risks.

Learning Objectives:

  • Understand why AI agents represent a fundamentally different security risk compared to traditional SaaS applications and human users
  • Learn how to discover, inventory, and classify AI agents operating across your SaaS ecosystem
  • Master practical techniques for enforcing least-privilege access controls and real-time runtime protection for agentic AI
  • Identify common attack vectors including prompt injection, privilege escalation, and agent-to-agent exploitation
  • Develop a roadmap for integrating AI agent security into existing governance frameworks and incident response playbooks

You Should Know:

  1. The Agentic Attack Surface: Why AI Agents Break Traditional Security Models

Unlike simple chatbots that respond and suggest, agentic AI plans, acts, and executes autonomously—calling APIs, modifying workflows, and accessing sensitive data without waiting for human confirmation. Gartner forecasted that 40% of enterprise applications would feature task-specific AI agents by 2026, up from less than 5% in 2025. This explosive growth has created what security researchers describe as a “lethal trifecta”: agents that combine access to private data, exposure to untrusted content, and the ability to take autonomous actions.

Three fundamental factors make AI agents uniquely dangerous:

  • The Citizen Developer Governance Gap: Unlike vetted IT software, SaaS agents are often deployed by business unit users in HR, marketing, or finance who prioritize productivity over security protocols.
  • Human Privileges with Non-Human Identities: SaaS agents inherit the full access of their creators and operate 24/7 without ever needing multi-factor authentication.
  • The “Confused Deputy” Vulnerability: Agents are built to be helpful, making them exploitable. An attacker doesn’t need to breach the agent—they only need to provide a poisoned instruction.

Practical Step: Auditing Your Agent Footprint

To begin securing your environment, you must first discover what AI agents exist. Run the following commands to identify potential AI agent integrations across common SaaS platforms:

Linux/macOS – Checking for OAuth tokens and service account credentials that may indicate AI agent deployments:

 List all OAuth tokens and service accounts with recent activity
find ~/.config -1ame "oauth" -o -1ame "token" -o -1ame "service-account" 2>/dev/null | xargs ls -la 2>/dev/null

Check for environment variables that may contain API keys for AI services
env | grep -i "api_key|secret|token|ai|openai|anthropic|servicenow|salesforce" | sort

Scan for configuration files containing AI agent references
grep -r "agent|copilot|assist|agentforce" /etc/ 2>/dev/null | head -50

Windows PowerShell – Identifying AI agent-related credentials and configurations:

 List environment variables related to AI services
Get-ChildItem Env: | Where-Object { $_.Name -match "API_KEY|SECRET|TOKEN|AI|OPENAI|SERVICENOW" }

Search for configuration files containing agent references
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue -Include .json,.config,.yml | Select-String "agent|copilot|assist" | Select-Object -First 50

Check scheduled tasks that may invoke AI agents
Get-ScheduledTask | Where-Object { $_.TaskName -match "ai|agent|copilot" }
  1. Building an Agent Inventory: You Can’t Secure What You Can’t See

According to AppOmni research, 85% of SaaS vendors now ship AI features by default, turning every platform into an unreviewed AI deployment. Security teams often have no visibility into which agents exist, what data they can access, or what actions they’re authorized to take. Dormant agents with live access represent a persistent and underappreciated exposure.

Step-by-Step Guide to Agent Discovery and Inventory:

  1. Identify AI-capable SaaS platforms in your environment: ServiceNow (Now Assist), Salesforce (AgentForce), Microsoft 365 (Copilot), and similar platforms.
  2. Map agent capabilities and declared scope: Document each agent’s tools, descriptions, identities, permissions, and access privileges.
  3. Identify over-permissioned agents: Flag agents with access that could cause catastrophic damage if exploited through prompt injection or misunderstood instructions.
  4. Establish continuous monitoring: Agent sprawl is no longer a future problem—it’s already deployed.

Practical Command – Auditing ServiceNow AI Agent Configurations:

For organizations using ServiceNow, the following REST API queries can help inventory AI agent configurations:

 Query ServiceNow for AI agent configurations (requires admin credentials)
curl -X GET "https://YOUR_INSTANCE.service-1ow.com/api/now/table/sys_ai_agent" \
-u "admin:PASSWORD" \
-H "Accept: application/json" | jq '.result[] | {name: .name, active: .active, capabilities: .capabilities}'

List agent-to-agent discovery settings
curl -X GET "https://YOUR_INSTANCE.service-1ow.com/api/now/table/sys_ai_agent_discovery" \
-u "admin:PASSWORD" \
-H "Accept: application/json" | jq '.result[] | {agent: .agent, discoverable: .discoverable, team: .team}'

Identify agents with excessive permissions
curl -X GET "https://YOUR_INSTANCE.service-1ow.com/api/now/table/sys_user_has_role?sysparm_query=user.role=admin" \
-u "admin:PASSWORD" \
-H "Accept: application/json" | jq '.result[] | select(.user.name | contains("ai_agent"))'
  1. The BodySnatcher Vulnerability: A Case Study in Agentic AI Risk

In October 2025, AppOmni researchers discovered CVE-2025-12420, dubbed “BodySnatcher”—a critical vulnerability in ServiceNow’s Now Assist AI Agents and Virtual Agent API. The flaw, carrying a CVSS score of 9.3 out of 10, allowed unauthenticated users to execute agentic workflows with the privileges of any user and create backdoor accounts with admin roles.

The vulnerability demonstrated how default settings can enable second-order prompt injection attacks—a sophisticated exploit method where low-privileged users embed malicious instructions in data fields that higher-privileged users’ AI agents later process. The compromised agent could then recruit other more powerful agents to execute unauthorized actions, including accessing restricted records, modifying data, and escalating user privileges.

Critical Takeaway: These attacks succeeded even with ServiceNow’s prompt injection protection feature enabled, highlighting how configuration choices can undermine security controls embedded in AI systems themselves. The researchers found that default settings automatically grouped agents into teams and marked them as discoverable, creating unintended collaboration pathways.

Mitigation Commands – Securing ServiceNow AI Agents:

 Verify patched versions are installed (Now Assist AI Agents 5.1.18+, 5.2.19+)
curl -X GET "https://YOUR_INSTANCE.service-1ow.com/api/now/table/sys_ai_agent_version" \
-u "admin:PASSWORD" \
-H "Accept: application/json" | jq '.result[] | {version: .version, status: .status}'

Disable automatic agent discovery and teaming
curl -X PATCH "https://YOUR_INSTANCE.service-1ow.com/api/now/table/sys_ai_agent_discovery_settings" \
-u "admin:PASSWORD" \
-H "Content-Type: application/json" \
-d '{"auto_discovery": "false", "auto_team_creation": "false"}' \
-H "Accept: application/json"

Isolate agents into function-based teams with explicit controls
curl -X POST "https://YOUR_INSTANCE.service-1ow.com/api/now/table/sys_ai_agent_team" \
-u "admin:PASSWORD" \
-H "Content-Type: application/json" \
-d '{"name": "restricted_agents", "discoverable": "false", "requires_human_approval": "true"}' \
-H "Accept: application/json"

4. Real-Time Runtime Protection: The AgentGuard Approach

Traditional security tools fail to protect AI agents because they operate at the wrong layers. CSPM tools can detect misconfigured cloud resources but cannot interpret whether an agent’s legitimate database call was driven by a prompt injection. CWPP instruments at the process layer, but AI agent behavior lives at the application layer.

AppOmni’s AgentGuard addresses this gap by acting as a real-time intercept layer inside SaaS environments, monitoring AI agent interactions across chat, Model Context Protocol (MCP), and agent-to-agent communication channels. It operates as a prompt firewall that scans every prompt for injection attacks, jailbreak attempts, and policy violations before the agent takes action.

Key Capabilities of Runtime AI Agent Protection:

  • Real-time prompt inspection: Every prompt is scanned for malicious content before execution
  • Preventative policy enforcement: Policies are enforced in real-time, not in post-processing log reviews
  • AI-1ative DLP integration: Existing DLP policies are enforced for sensitive data and PII on AI agents
  • Automated user quarantine: Repeat offenders are automatically quarantined and access is removed
  • Security-grade telemetry: Normalized, actionable security events are generated for SIEM ingestion

Configuration Example – Deploying Runtime Protection:

 Example AgentGuard policy configuration (YAML)
agentguard:
mode: "blocking"  Options: blocking, monitoring
risk_threshold: "medium"  Options: low, medium, high
custom_rules:
- name: "block_pii_exfiltration"
pattern: "\b(SSN|PII|credit_card)\b"
action: "block"
- name: "block_sql_injection"
pattern: "('|--|;.DROP|;.SELECT)"
action: "block"
quarantine:
enabled: true
threshold: 3  Number of violations before quarantine
duration: 3600  Quarantine duration in seconds
siem_integration:
enabled: true
endpoint: "https://your-siem.example.com/ingest"
format: "json"
  1. Treating AI as an Identity: The Shift to Agent-Centric Governance

Security teams must treat AI as an identity within the SaaS environment and enforce clear controls over how it operates. AI agents act as users, interact across SaaS applications, and often operate with broad access to sensitive data. This introduces a new challenge where security teams must start treating AI and non-human identities (NHIs) similarly to human identities.

Practical Identity Governance Steps:

  1. Register each AI agent as a distinct identity: Assign ownership, define purpose, and manage lifecycle for every agent identity
  2. Apply least-privilege access controls: Use the same role-scoping and approval workflows you use for new human users
  3. Audit model settings: Review data-retention flags, callback URLs, and configuration just as you audit SSO or MFA
  4. Monitor for “shadow permissions” and entitlement sprawl: Identities accumulate access privileges across multiple applications without sufficient visibility

Command – Auditing AI Agent Permissions Across SaaS:

 Check Salesforce AgentForce permissions
curl -X GET "https://YOUR_INSTANCE.salesforce.com/services/data/v58.0/query?q=SELECT+Id,Name,Permissions+FROM+1ermissionSet+WHERE+Name+LIKE+'%Agent%'" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" | jq '.records[] | {name: .Name, permissions: .Permissions}'

Audit Microsoft 365 Copilot access
 Using Microsoft Graph API
curl -X GET "https://graph.microsoft.com/v1.0/users?$filter=userType eq 'Guest'" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" | jq '.value[] | {displayName: .displayName, userPrincipalName: .userPrincipalName}'

Check for over-scoped API tokens
curl -X GET "https://YOUR_INSTANCE.service-1ow.com/api/now/table/sys_oauth_token?sysparm_query=scope%3Dadmin" \
-u "admin:PASSWORD" \
-H "Accept: application/json" | jq '.result[] | {name: .name, scope: .scope, active: .active}'

6. The OWASP Agentic AI Threat Landscape

The OWASP Top 10 for LLM Applications identifies the most critical security risks facing AI systems. For agentic AI specifically, the top risks include:

  • LLM01 – Prompt Injection: Attackers manipulate agents through poisoned instructions
  • LLM02 – Sensitive Information Disclosure: Confidential data exposed in prompts or responses
  • Excessive Agent Permissions: Agents with access beyond their intended scope
  • Agent-to-Agent Exploitation: Compromised agents recruiting other agents to execute unauthorized actions
  • Model Context Protocol (MCP) Vulnerabilities: Tool poisoning attacks where hidden malicious instructions manipulate agent behavior

Frameworks such as the NIST AI Risk Management Framework, the OWASP Agentic AI Threats taxonomy, and MITRE ATLAS provide structured starting points for security teams. Organizations can leverage MITRE ATLAS to model potential threats against their AI agents.

Detection Script – Monitoring for Prompt Injection Attempts:

!/usr/bin/env python3
 Simple prompt injection detection script for log analysis

import re
import sys
import json

SUSPICIOUS_PATTERNS = [
r'ignore previous instructions',
r'system:.override',
r'you are now.(admin|root|superuser)',
r'drop\s+table',
r'SELECT.FROM.WHERE',
r'../../',
r'base64.decode',
r'eval\s(',
r'exec\s(',
]

def scan_prompt(prompt):
findings = []
for pattern in SUSPICIOUS_PATTERNS:
if re.search(pattern, prompt, re.IGNORECASE):
findings.append(pattern)
return findings

Example usage
if <strong>name</strong> == "<strong>main</strong>":
for line in sys.stdin:
try:
data = json.loads(line)
prompt = data.get('prompt', '')
findings = scan_prompt(prompt)
if findings:
print(f"ALERT: Suspicious patterns detected: {findings}")
print(f" {prompt[:200]}...")
except json.JSONDecodeError:
continue

What Undercode Say:

  • Key Takeaway 1: The ServiceNow BodySnatcher vulnerability (CVE-2025-12420) demonstrates that agentic AI vulnerabilities are not theoretical—they are actively exploitable and can lead to complete account takeover. Organizations must prioritize patching and configuration hardening immediately.
  • Key Takeaway 2: Traditional security tools (CSPM, CWPP, IAM) operate at the wrong layers to protect AI agents. Organizations need purpose-built runtime protection that monitors agent behavior at the application layer, not just infrastructure posture.

Analysis: The convergence of autonomous AI agents with enterprise SaaS platforms represents one of the most significant security paradigm shifts in recent years. Unlike traditional software vulnerabilities that require attackers to breach perimeter defenses, agentic AI vulnerabilities can be exploited by anyone who can craft a malicious prompt—including low-privileged users or even external actors. The fact that default settings in major platforms automatically enable agent discovery and teaming without requiring explicit security review suggests that the industry is repeating the same mistakes made during the early days of cloud adoption: prioritizing speed-to-market over security-by-design.

Security leaders must recognize that AI agents are not just another application—they are autonomous actors with human-level privileges that operate without human oversight. The “confused deputy” problem is not a theoretical concern; it is a practical attack vector that has already been demonstrated in production environments. Organizations that fail to treat AI agents as first-class identities with their own governance, monitoring, and incident response will find themselves increasingly vulnerable to data exposure events that bypass traditional security controls.

Prediction:

  • -1 The proliferation of AI agents without commensurate security controls will lead to a wave of high-profile data breaches in 2026-2027, as attackers shift focus from traditional application vulnerabilities to prompt injection and agent-to-agent exploitation. The average cost of breaches involving compromised AI agents will likely exceed the current $4M average due to the scale and speed at which agents can exfiltrate data.
  • -1 Regulatory frameworks will lag behind technological reality, creating a compliance gap where organizations are technically compliant with existing standards (e.g., SOC2, ISO 27001) while remaining vulnerable to AI-specific attacks that fall outside traditional audit scopes.
  • +1 The emergence of AI-SPM (AI Security Posture Management) as a distinct category will drive innovation in runtime protection, agent discovery, and identity governance. Organizations that adopt these solutions early will gain a competitive advantage in security posture and regulatory readiness.
  • +1 The integration of real-time AI agent protection with existing SIEM and SOAR platforms will enable security teams to detect and respond to AI-related threats using familiar workflows, reducing the learning curve and accelerating adoption.
  • -1 The “citizen developer” trend—where business users deploy AI agents without IT oversight—will create a shadow AI epidemic that mirrors the shadow IT challenges of the past decade, but with significantly higher risk due to the autonomous nature of agentic AI.
  • +1 Frameworks like MITRE ATLAS and NIST AI RMF will mature and provide standardized taxonomies for AI agent threats, enabling better threat intelligence sharing and more effective defensive strategies.

▶️ Related Video (78% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Appomni 1 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: