A data exposure condition where information can leak without the victim deliberately opening a file or approving an action. In practice, the problem sits at the boundary between content processing, application trust, and data access, making it especially dangerous when assistants or automated workflows are involved.
Expanded Definition
Zero-click disclosure describes a condition where data becomes exposed without a user deliberately opening a file, approving a prompt, or taking any overt action. In NHI and agentic AI environments, that exposure often happens during background parsing, indexing, sync, preview generation, or automated tool execution. The risk is not limited to malicious payloads. It can also arise from legitimate content that is handled too trustingly by agents, applications, or integrations.
Definitions vary across vendors because some describe the issue as a vulnerability class, while others treat it as an outcome of unsafe content processing. For NHI Management Group, the practical distinction is whether the exposure occurs before a meaningful trust decision is made. That makes zero-click disclosure adjacent to, but not identical with, phishing, prompt injection, and arbitrary code execution. It is especially relevant when credentials, tokens, or internal context are reachable through automated workflows governed by NIST Cybersecurity Framework 2.0 controls for data protection and access governance.
The most common misapplication is assuming that “no user click” means “no trust boundary was crossed,” which occurs when background services process untrusted content with the same privileges as primary applications.
Examples and Use Cases
Implementing zero-click disclosure controls rigorously often introduces latency, compatibility, and observability constraints, requiring organisations to weigh user convenience against the cost of stricter isolation and inspection.
- An email client previews an attachment and renders embedded content before the recipient opens it, exposing metadata or tokens cached by the application.
- An agent ingests a document, follows embedded instructions, and leaks internal context through a connected tool, echoing patterns discussed in the Gemini CLI Breach — Silent Code Execution research note.
- A collaboration platform indexes shared files for search and accidentally surfaces sensitive text to users with broader workspace visibility than intended.
- A preview service fetches remote content and executes rich media or scripts in a permissive sandbox, causing disclosure before any deliberate interaction.
- An automated workflow reads a ticket, extracts secrets from attached logs, and forwards them into another system without human review.
These cases show why zero-click disclosure is often a property of the processing pipeline, not just the file itself. The underlying lesson aligns with NIST Cybersecurity Framework 2.0 guidance on limiting trust, protecting data in motion, and constraining how systems handle unverified inputs.
Why It Matters in NHI Security
Zero-click disclosure becomes especially dangerous when the exposed material includes service account credentials, API keys, session tokens, or agent instructions. NHI Management Group research shows that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, which illustrates how a single silent exposure can turn into a broad compromise. In NHI environments, the blast radius is often larger because NHIs are widely distributed, frequently over-privileged, and embedded in automated systems.
The governance issue is not only detection but containment. If a disclosure occurs through an indexer, preview engine, or assistant plugin, downstream systems may already have copied the data, normalized it, or cached it elsewhere. That is why related controls such as lifecycle management, secret rotation, and workload identity boundaries matter even when the original event looks like a simple content-handling issue. The threat model overlaps with identity misuse, but the trigger is often passive content processing rather than interactive compromise.
Organisations typically encounter the operational impact only after a secret appears in logs, search results, or assistant output, at which point zero-click disclosure becomes unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Addresses secret exposure and unsafe handling of credentials in NHI systems. |
| OWASP Agentic AI Top 10 | A2 | Agentic workflows can disclose data through tool use without explicit user approval. |
| NIST CSF 2.0 | PR.DS | Focuses on protecting data at rest, in transit, and during processing. |
| NIST Zero Trust (SP 800-207) | SC-4 | Zero trust limits implicit trust in content-processing paths and connected services. |
| NIST AI RMF | AI RMF covers unsafe outputs and data leakage from AI-enabled systems. |
Reduce disclosure risk by isolating secrets, limiting reachability, and reviewing where automation can read or copy them.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
