A PDF instruction that runs when a document is opened, rather than when a user clicks a visible control. Attackers abuse open actions to trigger remote connections, embedded scripts or other behaviour before the user understands the file is malicious.
What Open Action Means in PDF Security
An open action is a document-level instruction that executes automatically when a PDF opens. It is part of the file’s active content, so it can behave like a hidden trigger rather than a user-visible control.
How Open Actions Behave
Open actions are evaluated as part of the document’s initial load or render process. That means the action can run before the reader has intentionally interacted with the file, which makes it especially useful for unexpected redirects, remote content retrieval, or script execution embedded in the document.
In practice, open actions are one of the reasons PDFs are treated as active documents rather than inert containers. A file can look like a normal attachment while still containing logic that changes what happens as soon as it is opened.
Why Attackers Abuse Open Actions
Attackers use open actions to shift execution ahead of user awareness. A malicious PDF may initiate a network request, launch an embedded script, or chain into another payload as part of the open sequence, reducing the chance that the user will recognize the file as hostile in time.
Because the action occurs at open time, it can support early-stage delivery, tracking, or detonation behavior. That makes it a convenient mechanism for document-based intrusion attempts where the file itself is the first execution point.
Open actions are closely related to the broader security problem of active document content, where hidden instructions, embedded objects, and automatic behaviors expand the attack surface beyond the visible page. For a wider view of document and attachment abuse patterns, the NIST Cybersecurity Framework 2.0 helps frame the governance and detection side of managing such exposure.
How Defenders Should Think About It
Open actions are not dangerous simply because they exist; they become risky when an organisation allows active PDF features to reach users without inspection, sanitization, or trust controls. The practical question is whether the file is treated as passive content or as code-bearing content.
Defenders usually care about whether the environment permits automatic document behavior, whether security tools can inspect it reliably, and whether users can open externally sourced PDFs without isolation. That concern sits alongside broader control areas such as content inspection, sandboxing, and least-privilege handling of user-facing file content.
For policy and control mapping, document-driven execution fits naturally with NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organizations need controls for system integrity, content handling, and access enforcement around untrusted files.
Risk and Threat Considerations
Open actions create risk because they let a document do work before the user has made an informed trust decision. That can be used to trigger network callbacks, initiate secondary payload delivery, or reinforce phishing and malware campaigns that rely on seemingly ordinary office files.
Failure mechanism: The PDF engine processes the embedded open action at load time, so malicious logic can execute without a click on a visible control and without any obvious warning to the recipient.
Impact: This can expose users to covert data collection, remote content loading, script execution, or the first stage of a broader compromise chain, especially when document controls are not restricted or monitored.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.PS-01 — Platform Security | Open actions are an active document behavior that must be constrained by secure content handling. |
| Recommendation — Restrict active document features and sandbox untrusted PDFs before user opening. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Open actions can carry or trigger malicious code behavior when a PDF is opened. |
| SC-18 — Mobile Code | Open actions are a form of embedded executable behavior inside a document. | |
| Recommendation — Scan and block PDFs that contain active content or suspicious embedded actions. Prohibit or tightly control active document behaviors in files from untrusted sources. | ||
| MITRE ATT&CK | T1204 — User Execution | Open actions exploit document-opening behavior to trigger activity when a file is opened. |
| Recommendation — Model PDF open-action abuse as user-execution delivery and hunt for suspicious document launches. | ||
Practitioner Guidance
What to watch for: Treat externally sourced or unsolicited PDFs as potentially active content, not just documents. The strongest operational signal is a file that behaves differently at open time than it appears to on the page, especially when it reaches out to remote resources or launches unexpected document behavior.
Practitioner takeaway: Open actions are a reminder that file-format trust is an access-control decision as much as a content-review decision, so security teams should assume malicious intent whenever a document is allowed to execute automatically.
Related resources from NHI Mgmt Group
- What is the difference between an open action layer and a model that also controls execution?
- What is the 'no prompt means no action' principle in Agentic AI security?
- When should organisations require human approval for an AI agent action?
- What is the difference between flagging and blocking an AI agent action?