A condition where malicious code runs without the victim taking a deliberate action such as clicking or confirming. In AI environments, this often happens when generated output is auto-rendered in a live preview and the security boundary is assumed to be a review step when it is really an execution step.
Expanded Definition
Zero-click execution describes a failure of the expected interaction boundary: content, code, or output is treated as passive for review, but the platform processes it as active material. In cybersecurity, that can mean parsing a file, rendering a document, or deserialising content in a way that triggers unintended code paths. In AI and agentic systems, the same pattern appears when generated output is auto-rendered, handed to a plugin, or passed into a tool chain without a deliberate confirmation step. The key issue is not whether a human clicked, but whether the system assumed a human-gated review where execution semantics already existed. This is why zero-click execution is best understood as a boundary-design problem, not just an exploit technique. NHI Management Group treats it as an identity-adjacent risk when agents, service accounts, or workflow identities can act on untrusted output without a meaningful trust check. For a broad governance frame, the NIST Cybersecurity Framework 2.0 is useful because it emphasises managing technical risk across protect, detect, and respond functions. The most common misapplication is assuming a preview pane is safe when the application silently executes embedded content, scripts, or tool calls during rendering.
Examples and Use Cases
Implementing zero-click protections rigorously often introduces friction, because teams must slow down convenient preview and auto-processing paths to preserve a safer trust boundary.
- A document preview service renders a malicious file and the embedded parser triggers code execution before any user interaction occurs.
- An AI chat interface auto-renders markdown, HTML, or embedded media, and a payload in the output reaches an unsafe browser or plugin path.
- A workflow engine ingests a model response and immediately calls downstream tools, turning untrusted text into an execution request.
- A helpdesk or SOC platform opens an attachment in a sandbox poorly isolated from the production session, allowing execution to escape the expected review step.
- A browser-based console previews code snippets or configuration blocks, but embedded directives are interpreted as active instructions by the client or extension layer.
These cases show why secure rendering, content sanitisation, sandboxing, and explicit user confirmation are distinct controls rather than interchangeable safeguards. Guidance from OWASP is especially relevant when untrusted input can cross from display into execution, and the principle also maps to platform hardening practices reflected in NIST SP 800-53 control families around system and communications protection.
Why It Matters for Security Teams
Zero-click execution matters because it defeats one of the most common informal security assumptions in modern systems: that a human review step interrupts risk. Once that assumption fails, detection becomes harder, incident response becomes slower, and containment depends on whether the surrounding platform was designed to prevent content from becoming action. For AI and NHI-heavy environments, the issue becomes sharper because autonomous agents, service identities, and integration tokens can transform a seemingly harmless output into an authorised action path. That makes the term relevant to access governance, workflow design, and secure-by-default platform architecture, not just exploit remediation. Teams should map where untrusted input can enter renderers, browsers, orchestrators, and tool-using agents, then remove implicit execution paths wherever possible. The distinction is operational, not cosmetic: a preview is safe only if it cannot mutate state, invoke tools, or reach privileged credentials. The NIST Zero Trust Architecture model is helpful here because it reinforces the need to distrust implicit boundaries and verify every transition of authority. Organisations typically encounter the impact only after a seemingly harmless preview, attachment, or model response has already launched an attack chain, at which point zero-click execution becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.PT | Zero-click execution is a platform protection issue that CSF addresses through secure system design. |
| NIST SP 800-53 Rev 5 | SC-18 | Addresses mobile code and untrusted content handling relevant to zero-click execution paths. |
| OWASP Agentic AI Top 10 | Agentic AI guidance covers unsafe tool invocation from generated output and implicit execution paths. | |
| OWASP Non-Human Identity Top 10 | NHI guidance is relevant when service identities or workflows execute untrusted content automatically. | |
| NIST Zero Trust (SP 800-207) | Zero Trust rejects implicit trust in previews, outputs, or internal boundaries that enable silent execution. |
Harden renderers, parsers, and workflow paths so untrusted content cannot become active execution.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
