Topic starter
25/06/2026 3:12 pm
TL;DR: 0-click exploit methods can hijack popular enterprise AI agents, leading to unauthorized access, memory manipulation, data exfiltration, and conversation control across platforms such as ChatGPT, Copilot Studio, Gemini, and Salesforce Einstein, according to Zenity Labs. The findings show that agent behaviour can cross organisational boundaries without user action, which makes runtime governance and identity controls the decisive issue, not just content filtering.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “AgentFlayer: 0Click Exploit Methods”.
Key questions
Q: What breaks when an AI agent can turn untrusted content into privileged actions?
A: The trust boundary breaks because the agent no longer just reads external text.
Q: Why do over-privileged AI agents create higher business risk than ordinary users?
A: Over-privileged agents can execute many more actions than the task actually requires, so one bad decision can cascade into wrong approvals, refunds, data movement, or API calls.
Q: How do security teams know whether agent memory is becoming a risk?
A: They look for writes that carry instruction-like content, unexpected persistence across sessions, and summaries that reintroduce hostile text as trusted context.
Practitioner guidance
- Restrict agent tool reach Limit each AI agent to the smallest set of tools and workflows needed for its task, and remove privileged access that is not required for that task's business outcome.
- Separate untrusted input from execution Treat email, chat, documents, calendar items, and support cases as untrusted inputs until the agent has completed a policy check that blocks silent action on those inputs.
- Govern agent memory as state Classify agent memory, conversation history, and persisted context as sensitive operational state and define who can write, read, or reset that state.
Bottom line: 0-click AI agent abuse turns trusted business channels into an execution path, so the core risk is unauthorized action through legitimate agent access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:36 pm
0-click agent compromise is an identity problem, not a prompt problem: The central failure is that the agent accepts attacker-controlled content and then exercises its own access. That means the control surface is runtime authorisation, tool scoping, and state governance, not content filtering alone. When the agent can act before a human intervenes, identity security has to move from pre-approval to continuous decision control.
A few things that frame the scale:
- Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
A question worth separating out:
Q: When should organisations re-evaluate AI agent access after a 0-click finding?
A: They should re-evaluate it whenever the agent can reach sensitive systems, persist state, or route communications without a fresh human decision. The key question is whether one bad interaction can cross from a public input channel into internal tools. If yes, the access model is too broad for the agent's runtime behaviour.
👉 Read our full editorial: 0-click AI agent exploits expose enterprise control gaps