Zero-click prompt injection: what happens when it starts spreading?

TL;DR: Zero-click prompt injection can evolve from a single-victim leak into a self-replicating worm when malicious prompts are embedded in emails and later reused by retrieval-augmented agents, according to Verno Labs research. The security problem is no longer just exfiltration; it is uncontrolled propagation through trusted AI workflows, where context mixing and outbound actions turn one compromised interaction into a broader campaign.

Editorial analysis by NHI Mgmt Group, based on content published by Verno Labs: “Zero-click evolution, part 2: when the injection learns to spread, and the gap Verno Labs is closing”.

Key questions

Q: What breaks when an AI agent can read private data and send it externally?

A: The agent can become an exfiltration path instead of a productivity layer.

Q: Why do zero-click leaks create more risk than ordinary data exposure?

A: Because the user does not need to trigger the disclosure.

Q: What are the signs that an AI-integrated workflow is being abused by prompt injection?

A: Look for unexpected outputs, new records that the user did not intentionally create, data summaries appearing in the wrong context, and actions that follow hidden instructions embedded in otherwise trusted content.

Practitioner guidance

• Constrain agent data scope Limit what any single agent session can retrieve before it is asked to summarize, reply, or act so a compromised interaction exposes less context.
• Insert a hard approval gate for high-impact actions Require explicit approval before the agent can send data, execute code, or move money so a malicious prompt cannot quietly complete the action path.
• Disable auto-rendering of remote content Turn off automatic image loading, previews, and other remote fetches anywhere an agent is in the loop because those features can remove the last click and enable zero-click exploitation.

Bottom line: Zero-click prompt injection can now behave like a propagation mechanism, not just a data leak.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →