Top 10 zero-click attacks against AI agents

Ten documented attacks where the victim clicked nothing, approved nothing, and lost data or control of the machine anyway. What each one broke, the CVEs that followed, and what stops them.

The control that isn’t there

Enterprise AI deployments rest on one assumption: a human sits in the loop. An approval prompt or a review step is mandatory before anything consequential happens. Every attack on this list routes around that assumption by never asking the human anything.

Zero-click means the victim takes no action outside their normal workflow. They ask their assistant a routine question, or a CI pipeline runs a build, and the attacker’s instructions execute, carrying the victim’s identity and permissions.

Nine of the ten below were reachable in a commercially shipped product. Three of them carry CVEs, mostly scored 9.3 or above. The other seven were handled without CVE, either patched without an advisory or declined outright, and in three cases the vendor’s first answer was that the behavior fell outside its threat model.

The ranking is based on severity/impact, then how much each one moved the agentic AI security field.

1. EchoLeak

Microsoft 365 Copilot • CVE-2025-32711 • CVSSv3.1 9.3 critical • disclosed June 2025 • patched server-side

An attacker sends an ordinary-looking email. The injection is worded to slip past Microsoft’s XPIA classifier by never mentioning Copilot or AI at all. The message sits in the inbox, unopened.

Later the user asks Copilot something unrelated. Retrieval pulls the attacker’s text into context, and the injected instructions tell Copilot to gather what it can reach across chat history, OneDrive, SharePoint, and Teams, then embed it in a reference-style Markdown image URL pointing at attacker infrastructure. Copilot clients pre-fetch images automatically, so the data leaves without anything being clicked. The chain defeated four separate controls: the classifier, link redaction, CSP, and reference-mention handling.

The underlying pattern is called LLM Scope Violation: untrusted input in context causes the model to reach for privileged data it should never mix with. Microsoft patched it in May 2025 and reported no exploitation in the wild.

Coverage: Dark Reading • The Hacker News

2. DuneSlide

Cursor • CVE-2026-50548 and CVE-2026-50549 • CVSSv4.0 9.3, 9.8 • fixed in Cursor 3.0

Two sandbox escapes in Cursor’s agent terminal, both reachable through prompt injection planted in something the agent reads on the user’s behalf: an MCP server response or a web search result. No dialog, no approval.

The first abuses the working_directory parameter on the run_terminal_cmd tool. Cursor’s sandbox grants write access to a command’s working directory, so setting that parameter to a non-default path adds it to the allow list and lets the agent write outside the workspace. The second abuses the symlink check: Cursor canonicalizes a write target to confirm it stays in the workspace, but falls back to trusting the original path when canonicalization fails, which an attacker forces by pointing at a nonexistent target or stripping read permission from a directory in the path. The same class of canonicalization gap turned up across six coding agents in our SymJack research.

Both end identically. Overwrite the cursorsandbox helper binary, and every command after that runs unsandboxed with the developer’s full privileges. Cursor initially rejected the reports on the grounds that MCP server misuse was outside its threat model, then reopened and fixed.

Coverage: SecurityWeek • The Hacker News

3. TrustFall

Claude Code, Gemini CLI, Cursor CLI, Copilot CLI • no CVE • partly fixed

A cloned repository ships an MCP server in .mcp.json and self-approves it through project-scoped .claude/settings.json. The moment the developer accepts the generic folder trust prompt, the server spawns as an unsandboxed OS process with full user privileges. The payload runs at server startup, before any tool call, with no second prompt, and it can live inline in the JSON via node -e so no script ever touches disk for a scanner to catch.

The one-click version already hands an attacker the developer’s machine. The CI version needs no click at all: Claude Code running headlessly through the official action never renders a trust dialog, so the attacker’s MCP server executes against every pull request branch the workflow processes, with the runner’s process.env, deploy keys, and signing certs available to it.

All four CLIs tested auto-execute project MCP servers after folder trust, and all four default to yes. Anthropic declined the report as outside its threat model, holding that accepting the folder trust prompt constitutes consent to the full project configuration. They never mentioned how it should work in the headless CI/CD scenario.

Related CVEs in the same lineage: CVE-2025-59536, CVE-2026-21852, CVE-2026-33068.

Coverage: Dark Reading • The Register • Adversa AI blog

4. PleaseFix and PerplexedBrowser

Perplexity Comet, Claude in Chrome, Gemini in Chrome, ChatGPT Atlas, Copilot Edge • no CVE • disclosed March 2026, expanded at Black Hat USA 2026

The original Comet chain starts with a calendar invitation carrying an indirect prompt injection. The user asks the agent to accept the meeting, and everything after that runs unattended. The agent is walked to an attacker page whose instructions reframe local filesystem access as a game-like treasure hunt, carefully avoiding words like passwords or credentials, then guided to traverse directories, open files, and push contents out through ordinary browser navigation. No software vulnerability is exploited anywhere in that chain. Comet stays inside its intended execution model the whole way.

A second path turns agent-authorized workflows against password managers, lifting individual 1Password credentials or taking over the account without touching the password manager’s own security, all inside a legitimate authenticated session.

The Black Hat expansion made the class properly zero-click and much wider. A single malicious email and a routine request to summarize the inbox are enough, a technique called Intent Collision does the rest across five agentic browsers. Demonstrated outcomes included Gmail exfiltration, silent sharing of the victim’s entire Google Drive with the attacker, and account takeover on Slack, X, and Claude. One chain turned Claude in Chrome’s javascript_tool into arbitrary code execution on any site the agent visits, and it worked even in ask-before-acting mode.

The name PleaseFix emphasizes it is ClickFix retargeted at agents, where the social engineering no longer needs a human to fall for it.

Coverage: Dark Reading

5. ZombieAgent

ChatGPT with Connectors, including Gmail, Outlook, Drive, and GitHub • no CVE • fixed December 2025

Hidden directives ride in ordinary emails, documents, or web pages. The agent picks them up during a routine task such as inbox summarization, treats them as legitimate commands, and starts collecting mailbox data, reading files, and reaching external servers.

ZombieAgent writes attacker rules into the agent’s long-term memory, so the attacker never has to make contact again. The agent re-executes the hidden actions on every subsequent use and can forward the payload to new recipients, turning one email into a self-spreading campaign. Researchers report the technique also defeats the guardrails OpenAI added in response to the earlier disclosure, ShadowLeak.

All of it happens inside OpenAI’s cloud rather than on the endpoint or the corporate network, so no local log records it.

Coverage: CSO Online • SecurityWeek • Infosecurity Magazine

6. ShadowLeak

ChatGPT Deep Research agent • no CVE • fixed September 2025

One crafted email leaks Gmail inbox contents with no user action. The injection hides in the email HTML behind tiny fonts, white-on-white text, and layout tricks, so the user sees nothing while the agent reads and obeys.

Earlier attacks needed the victim’s client to render an image before the data escaped. ShadowLeak has the agent make the outbound request directly from OpenAI’s own infrastructure, which puts it out of reach of endpoint tooling and enterprise network controls alike. Server-side requests also face fewer URL restrictions than client-side ones, so the destination is close to unconstrained.

The Gmail proof of concept generalizes to every Deep Research connector, since Drive, Dropbox, SharePoint, Outlook, Teams, GitHub, HubSpot, and Notion can all carry an injection in content or metadata.

Coverage: The Hacker News • Infosecurity Magazine

7. GeminiJack

Gemini Enterprise and Vertex AI Search • no CVE • resolved by November 2025

The attacker shares a Google Doc, sends an email, or drops a calendar invite carrying hidden instructions. The target gets no notification and clicks nothing.

Later, any employee runs a normal Gemini Enterprise query, something as unremarkable as “show me our budgets”, and retrieval surfaces the poisoned document. The model executes the embedded instructions as legitimate commands, and because Gemini Enterprise reaches organizational Gmail, Calendar, Docs, and other Workspace sources, those instructions fan out across all of them. Results leave through a disguised external image request. Bait terms like “confidential”, “legal”, “salary”, or “API key” let an attacker aim at whatever the organization is most careful with.

Structurally this is EchoLeak transplanted to Google’s stack: the same trust boundary collapse, the same image-based exfiltration channel. Google validated the findings and changed how Gemini Enterprise and Vertex AI Search interact with their retrieval and indexing layers, separating the two products so they no longer share the same retrieval workflow.

Coverage: SecurityWeek • Infosecurity Magazine • SC Media

8. ShareLeak

Microsoft Copilot Studio • CVE-2026-21520 • CVSSv3.1 7.5 • fixed January 2026

The gap sits between a SharePoint form submission and a Copilot Studio agent’s context window. An attacker fills a public-facing comment field with a payload that injects a fake system role message, and in the tested scenario Copilot Studio concatenated that untrusted input directly with the agent’s system instructions, and nothing sanitized it in between. The injected instructions then drive the connected Copilot to pull customer data and mail it to an attacker-controlled address. DLP never fired because the exfiltration used a legitimate Outlook action, and data left even in runs where Microsoft’s safety mechanisms had flagged the request as suspicious.

Despite the modest-looking 7.5 severity rating, the vulnerability was quite dangerous. First, the entry point is a public form, so the attacker needs no foothold and no relationship with the target. Second, Microsoft issued a CVE for a prompt injection in an agent-building platform, which drags a large category of customer-built agents into the same conversation.

Coverage: Dark Reading • VentureBeat

9. Remote Copilot Execution

Microsoft 365 Copilot • no CVE • Black Hat USA, August 2024

Indirect prompt injection against a shipping product was already documented by 2023. This Black Hat session added the enterprise version, with a hijacked Copilot sitting on a real company’s mail, files, and search index.

Hidden instructions go into an ordinary email’s HTML rather than its visible body, and because Microsoft 365 Copilot pulls email by default as part of normal operation, the poisoned content enters the model’s context without the victim ever opening the message. The demos showed the assistant searching for, analyzing, and exfiltrating sensitive data through Bing search results; manipulating banking information in an answer while keeping the original file references so the response still looked sourced.

The speaker framed the class as the Copilot-world equivalent of remote code execution, on the reasoning that an outsider who takes control of a system that already acts on the user’s behalf inherits everything that system can do. This is separate from the LOLCopilot tool released in the same session, which needs the account compromised first.

Microsoft characterized the risks as comparable to other post-compromise techniques, and no CVE followed. Ten months later, structurally similar behavior in the same product was scored CVSS 9.3.

Coverage: Dark Reading • TechTarget

10. Morris II

Research, February 2024 • no CVE

Not everything above was predicted, but the worm was. The paper, published as ComPromptMized, showed that when GenAI applications talk to each other through RAG-based inference, an attacker can start a chain reaction with a single self-replicating prompt.

The prompt does three jobs at once. It makes the model reproduce it in the output, which is replication. It executes a payload, either spamming or exfiltrating personal data. And it uses the connectivity between applications to deliver itself into the next agent’s RAG store, which is propagation. Each infected application poisons the ones downstream.

The team demonstrated it against GenAI email assistants built on Gemini Pro, GPT-4, and LLaVA, in both black-box and white-box settings, with text and image payloads. The memory persistence and self-propagation stage in ZombieAgent, disclosed against a production system almost two years later, is the same idea shipped.

Coverage: Wired • paper (arXiv

What all ten have in common

Untrusted content reaches the model through a channel nobody classified as an attack surface: email that arrives by default, a document shared without notification, an MCP server response, a web search result, a form submission from a stranger. In none of these cases did a human choose to hand the agent that content.

The model cannot tell content from command, so retrieved text becomes instruction. Then the agent does the work with its own privileges, which are the user’s, or in CI the pipeline’s. That is the confused deputy problem with a language model in the deputy’s chair. The agent is behaving as designed. Nor is this a minority configuration: our AI Risk Quadrant report, which scored 100 production agents, found 98% of them already combine private data access, exposure to untrusted content, and outbound actions.

What changes from entry to entry is only the way out. EchoLeak and GeminiJack used Markdown image pre-fetch. ShadowLeak and ZombieAgent made server-side HTTP requests from the vendor’s own cloud, PleaseFix used ordinary browser navigation, and ShareLeak used a legitimate Outlook send. DuneSlide and TrustFall skipped the network and took the developer’s own shell instead. Close one channel, and the research moves to the next.

There is also a disclosure pattern that should worry anyone buying these products. Cursor rejected DuneSlide as MCP misuse outside its threat model. Anthropic declined TrustFall because folder trust implies consent. Microsoft treated Remote Copilot Execution as post-compromise. Each position is defensible in isolation. Collectively, they mean the boundary between “vulnerability” and “working as intended” is being drawn by the vendors whose products are on the wrong side of it.

What reduces the AI agent risk

Not one of these is “use a better model”, and not one is “more security awareness training for your staff”.

1. Classify retrieval as untrusted input to a privileged process. Any email, document, search result, MCP response or form field that can reach the context window is attacker-controlled input accessing a component with your users’ permissions.

2. Give the agent its own identity, narrower than the user’s. This is the single highest-leverage change for anyone running Copilot, Gemini Enterprise or connector-based assistants at scale.

3. Stop counting approval dialogs as controls. If a consent prompt is the only barrier between untrusted content and a capability, treat that capability as ungated. This is especially relevant for coding agents often run in YOLO/Skip-permissions mode.

4. Log where the agent runs, not only where the user sits. Retrieval events, tool calls, memory writes and outbound requests need to be captured at the agent runtime. Otherwise, half of the attacks are invisible by design.

5. Close the outbound channel when it’s irrelevant for specific agentic workflows. Disable automatic remote image fetching. Allowlist egress destinations at the agent runtime. Treat legitimate business actions as exfiltration primitives: sending mail, creating a calendar event, opening a URL. ShareLeak used one of those, and DLP detected nothing.

6. Monitor and assess the chain of agentic events. Most attacks could be broken down into steps, each of which appears legitimate and innocent. They look suspicious only when assessed together with sufficient context. This context includes retrieval, tool permissions, sandbox rules, output rendering, memory and consent UX. Only by observing the entire chain can you stop it before damage occurs. That runtime view of the chain is what our agent security platform is built to provide.