Agent API Containment Checklist for ServiceNow CVSS 10.0

If your agents read or write ServiceNow platform data, CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API, the data-access channel that ServiceNow's AI agents use to query and manipulate platform data. Three maximum-rated flaws, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, were assigned CVSS 10.0 scores and can be exploited without an authenticated session. ServiceNow published advisory KB3152242 on August 27, 2026 for four Now Platform and AI Platform flaws in Xanadu, Yokohama, and Zurich releases. A production agent is only as safe as the authentication, patching, and scope controls on the platform APIs it uses. An agent that can read or write through an exposed data channel is the entry point. The platform is the control. The control must be patched, scoped, and tested.

Patch the platform before auditing the agent

ServiceNow pushed the update to hosted instances and supplied the fix to partners and self-hosted customers, so self-hosted operators must apply it themselves. For self-managed environments, ServiceNow named the patched builds as Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4, Zurich through Patch 12, and Australia patches 2 through 5. ServiceNow said it had no current awareness of exploitation in each advisory record. Defused first said it had seen active exploitation of CVE-2026-6875 days after the July advisory, but later clarified that the observed payload corresponded to a proof of concept published by Searchlight Cyber. Treat an older build as an exposed agent API until you prove otherwise.

The five-step audit is the control

AI agents reach into data and tools to perform work, making them more capable and more dangerous than chatbots. Weaknesses in how agents identify themselves, delegate authority, or inherit privileges can let attackers obtain higher access, abuse confused-deputy paths, or perform unauthorized cross-system actions. Weak checks on authentication, integrity, or meaning in agent-to-agent messages can open the door to spoofing, tampering, replay, or manipulation. Agents can turn legitimate, authorized tools into channels for data theft or destructive actions, and observed cases include agents deleting databases and wiping hard drives. The audit below tests the controls that stop the misuse from becoming an incident.

• Confirm the patch level. Check the self-hosted ServiceNow build against the vendor's patched-build list.
• Verify authentication. Confirm the data API rejects anonymous requests and requires a scoped identity.
• Scope agent credentials. Give the agent the minimum table, field, and action rights needed for its job.
• Map agent-to-API calls. Log every call the agent makes to the data API and compare it against the expected workflow.
• Test for unauthenticated reachability. From an untrusted network, attempt to reach the data API without credentials and confirm it fails.

The patch removes the known defect. Without it, every later check is a workaround. Authentication is the first control. A failed control exposes the agent's data access. Scope limits the damage and makes the agent easier to audit. A call map turns the agent's behavior into evidence and reveals drift when the agent starts using a tool it should not need. The unauthenticated test is the first check an attacker runs. Run it from outside the trusted network.

Scope keeps the agent bounded

Modern systems let model outputs trigger tool calls, code generation, state inference, action authorization, and multi-agent coordination, so misinformation can become a system-level failure. OWASP's Sept. 2, 2026 LLM Top 10 guidance calls for enforceable controls over what autonomous AI systems can access, decide, and do, assuming they may fail or be deceived. The Agent Control Standard was donated to the OWASP GenAI Security Project, and the Sept. 2, 2026 release extends agentic AI guidance toward practical runtime enforcement. The checklist above is the minimum version of that control set.

Run the audit after every agent deployment, after every platform patch, and after any change to agent permissions. Keep the results with the agent's runbook. A failed check triggers a stop, a fix, and a retest. A production agent should not be running on a data API it cannot prove is contained.

Treat the agent's data API like a production service, not a lab endpoint. Give it a named owner, a change record, and a rollback path. For write access, add a second check before destructive actions. For read access, add a review for unusual query patterns.