---
title: "Zero-Click AI Agent Exploit Chains: What AgentFlayer Teaches Defenders"
description: "Enterprise agents acted for an outsider with nobody clicking anything. Where the budget belongs after AgentFlayer, and why the deterministic half of the stack comes first."
author: "Mara Voss"
category: "Attack Surface & Threat Modeling"
date: 2026-10-23T08:35:17.319Z
canonical: "https://agenticcyber.co/blog/zero-click-ai-agent-exploit-chains-what-agentflayer-teaches-defenders"
---

# Zero-Click AI Agent Exploit Chains: What AgentFlayer Teaches Defenders

![bridge, glienicke, berlin](https://cdn.pixabay.com/photo/2019/03/28/19/46/bridge-4087894_1280.jpg?w=1200&q=75)

> Enterprise agents acted for an outsider with nobody clicking anything. Where the budget belongs after AgentFlayer, and why the deterministic half of the stack comes first.

Nobody approved anything. A person asked an enterprise assistant for something unremarkable, the assistant read material that an outsider had seeded in advance, and from that moment it worked for the outsider instead. Zenity Labs took a collection of chains it named AgentFlayer to Black Hat USA in August 2025, and the uncomfortable part of that collection is that the victim never had a decision to make.

Most of what is public sits in four places: the finder's own research page, a detailed report by Lucian Constantin for CSO Online, trade coverage, and a recap the finder published a year later. Zenity sells into this market and also did the finding, so the severity framing is the finder's own and should be labelled that way in any internal brief. This piece stays at the level of mechanism and control. It carries no payload, no reproduction path, and no wording that would help rebuild a chain.

## Dates that are genuinely on the record

WhenWhat happenedWho reported it

Black Hat USA, August 2025Zenity Labs shows chains that need no user action, alongside others that need one[eSecurityPlanet](https://www.esecurityplanet.com/ja/news/ai-agents-vulnerable-silent-hijacking/)
8 August 2025A detailed account names the specific integrations and describes how data left each one[CSO Online](https://csoonline.com/article/4036868/black-hat-researchers-demonstrate-zero-click-prompt-injection-attacks-in-popular-ai-agents.html)
11 July 2025Salesforce reports the Einstein finding closed[The Decoder](https://the-decoder.com/agent-based-ai-systems-face-growing-threats-from-zero-click-and-one-click-exploits/)
29 July 2025Microsoft publishes its own defensive model for this attack class, naming the controls it ships[Microsoft Security Response Center](https://www.microsoft.com/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks)
12 August 2026The same researchers describe a follow-on class against agentic browsers[Zenity Labs](https://zenity.io/blog/ai-agent-security-black-hat-recap)
Not disclosedFix dates for most of the affected listNo source states them
Not disclosedAny use of these chains against a real organisationNo source found

Read the affected integrations as a list of patterns rather than brand names, because each is a different doorway into one failure. The four summaries below follow CSO Online's account, the most specific of the four.

- **A coding assistant wired to a ticket system.** Instructions arriving inside a Jira ticket, which can itself be fed automatically from a help desk queue, reached repository secrets. A ticket queue is a hostile input channel that happens to come with a support process attached.

- **A chat assistant with storage connectors.** A seeded document steered a search across linked cloud storage, and the findings left through rendered image addresses. The same account reports a link filter being stepped around by hosting the image on a reputable cloud domain. Note what that implies: a renderer that fetches a picture is already an egress channel, whether or not the agent has an outbound network tool.

- **A low-code customer service agent.** A copy of a vendor sample agent disclosed its own tool list and knowledge sources after reading mail, and then customer records.

- **Einstein, Gemini, Microsoft 365 Copilot.** Listed as affected in the coverage with very little detail attached to them. Treat this row as reported rather than as described, and go to each vendor's advisory before repeating it.

## Four links, told in the abstract

- **Seeding.** Wording is placed where the software will later read it, with no urgency and no deadline. An externally shared file, a portal ticket, an inbound mail, a calendar invitation, a record somebody outside the company can edit.

- **Ingestion inside ordinary work.** Somebody asks for a summary, or a sales rep runs a query they run every week. Nothing anybody does here is a mistake, which is precisely why this step leaves no trace in a post-incident interview.

- **The software follows the seeded wording.** Zenity's research page groups the outcomes into four kinds: reading data the requester had no right to, moving that data outward, writing into the agent's durable memory, and steering the conversation itself. Its low-code example states plainly that customer records came out and that tools were triggered from a distance.

- **Breadth arrives through connectors and persistence.** Trade coverage describes a linked file store being reached in the chat assistant case, and memories planted so that sessions which had not yet begun would inherit them.

No step in that sequence requires a person to err. For software built this way, reading is the trigger, and an awareness campaign cannot reach a step with no human standing in it.

## Each link, and the control that ends it

LinkControl that ends itWho owns itEffort

SeedingName every channel an outsider can write into, and class external shares, inbound mail and portal tickets as hostile by defaultSecurityMedium
IngestionHold the session that reads outside material apart from the session that carries privilege. Our note on [instructions crossing a boundary between agents](/how-adversarial-instructions-cross-agent-boundaries) covers the shape of that splitAgent builderHigh
The software followsAuthorisation on the real parameters rather than on a friendly summary of them, backed by [controls sitting at the action layer](/execution-gap-controls-at-the-agent-action-layer)Platform teamMedium
BreadthOne connector set per task, provenance on anything that becomes durable, and a route for a user to clear memoryAgent ownerLow, then medium

Soft and hard controls are not two grades of the same material. The Decoder reports Bargury describing the soft layer as "an imaginary boundary", and that phrase is doing real work: filters, system wording and training nudges change how often an attempt lands, and they do not change what the software is able to touch once it has been convinced. The reasoning behind that distinction is laid out further in our piece on [why filtering the input does not close this class](/why-input-filtering-does-not-stop-prompt-injection).

## What the platform vendor says it ships, and what each piece buys you

Microsoft published its own defensive model for exactly this class in July 2025, and it is more useful to defenders than most of the press coverage because it sorts the controls honestly. [The post, by Andrew Paverd of the Microsoft Security Response Center](https://www.microsoft.com/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks), splits the work into preventing the injection, detecting it, and preventing the impact, and it labels the first two as probabilistic.

On prevention, it names hardened system wording and a technique called Spotlighting, which marks untrusted text so the model can tell data from instruction. Spotlighting ships in three modes: delimiting, datamarking and encoding. On detection, it names Prompt Shields, a classifier that runs inside Azure AI Content Safety. That one has a price attached and it is worth understanding before you plan around it: [the service is billed per thousand text records](https://azure.microsoft.com/en-us/pricing/details/cognitive-services/content-safety/) in its standard tier, with a small monthly free allowance, so the running cost of detection scales with how much untrusted content your agents read rather than with how many agents you run.

The third group is where a defender should spend attention. [The same post](https://www.microsoft.com/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks) describes data governance through sensitivity labels and Microsoft Purview, including a data loss prevention policy that stops the assistant summarising a labelled file at all, plus deterministic blocking of known exfiltration routes such as image injection in markdown, and human approval patterns where a person has to press send. It also points at threat protection for AI workloads in Microsoft Defender for Cloud, with alerts landing in the Defender XDR portal, which is the first thing on that list that gives a security team an event to investigate rather than a setting to tick.

Two items on that page are research rather than product and do not belong in a control matrix: an information flow control approach called FIDES, and TaskTracker, which inspects a model's internal activations for signs of a hijack. Interesting, not purchasable.

## Where the budget actually belongs

The usual response to a disclosure of this kind is to buy a detector and wait for patches. Both are the wrong first spend, and the evidence for that sits inside the vendor's own documentation. The platform vendor itself files its injection detection under probabilistic, and files data governance and deterministic exfiltration blocking under preventing the impact. The trade account of the chat assistant case describes a link filter being stepped around by relocating an image to a trusted cloud host, which is the ordinary fate of a deny list. And a year after the first talk, the finder's own recap describes the same shape working against agentic browsers, so the class did not close.

So the call: fund the deterministic half first. Cut connector scope to the task, restrict which hosts an agent may fetch or render from, put approval on the genuine parameters of a high-impact action, and only then buy a classifier, treating its output as telemetry that tells you which agents are being probed. A detector that is wrong sometimes is a fine alarm and a poor wall. Teams that reverse this order usually discover the problem during an audit, when they can show a dashboard of blocked prompts and cannot answer what the agent could have reached had one got through.

A better detector would change this: if somebody publishes an injection detector with a measured catch rate against phrasings it has never seen, reproduced by a party that does not sell it, and holding up under adaptive pressure, then detection becomes a boundary and buying it first is rational. A smaller change applies to an agent that reads only public data, holds no connectors and keeps no memory. There the impact work is nearly free and already done, and detection is genuinely the remaining lever.

## A year on, the shape has not changed

In August 2026 the same team described a follow-on class it calls PleaseFix, using a technique it calls Intent Collision, in which hidden wording collides with the user's real request and bends the agent toward somebody else's goal. [Its recap](https://zenity.io/blog/ai-agent-security-black-hat-recap) names Claude in Chrome, Perplexity Comet and ChatGPT Atlas among the browsers tested, and states that some vendors patched quickly while others treated the behaviour as intended functionality. That is again the finder describing its own work, without independent reproduction, and it belongs in a brief as a claim rather than as a finding. The browser-specific side of this is covered in our write-up on [security for agentic browsers](/ai-browser-agent-security-agentic-browsers).

## Seven checks worth running this week

- Build the list of agents that read content an outsider can write, and keep it somewhere queryable rather than in a slide.

- For each of those, enumerate the connectors it holds today and remove every one its task does not require. Connector sets grow quietly and nobody re-reads them.

- Confirm fix status inside your own tenant for every affected platform you run, rather than inheriting it from an article. The two accounts here disagree about which vendors fixed what.

- Restrict the hosts an agent may fetch from or render, and include images and references able to carry data inside an address.

- Check whether a user can see and erase what the agent has remembered, and require review before anything becomes durable.

- Decide whether your approval prompts display the real parameters of the action or a paraphrase of them. A paraphrase is not an approval.

- Run an adversarial test that seeds wording into each untrusted channel from the first check, then score the agent's actions rather than whether a filter fired.

## Where the public record contradicts itself

The accounts do not agree on vendor response. Trade coverage reports that some vendors declined to change behaviour they consider intended, while the CSO Online account reports fixes from the chat assistant vendor and from the low-code platform vendor, and reports no vendor refusing. Both may be partly right: they were written at different moments about overlapping product lists. The consequence is simple. Patch status taken from press coverage is not evidence, and the only status that protects you is the one you can observe in your own tenant.

Beyond that, the fix state across the full product list cannot be confirmed from these sources. How often a chain of this shape succeeds against a hardened tenant is unknown, and no source documents use against a real organisation. Several details reach us only through secondary coverage. One sentence for a leadership audience: nothing has to be clicked, so the control has to live in the reach of the software, not in the habits of the person using it. No single item above is complete. Each one either lowers the chance or caps the damage.

## Questions about ingestion-triggered agent compromise

### If nobody clicks, what sets the chain off?

Reading does. The agent consumes content that an outsider shaped, during a task the requester considers routine, and treats the wording it finds there as part of the job.

### Does one vendor's fix close this for us?

No. A fix addresses a specific route, and the coverage here disagrees about which routes were closed. Confirm the state of your own tenant and settings, then assume the class is still live.

### Is an injection classifier worth buying at all?

It is worth buying as an alarm and as telemetry, after connector scope and egress limits are in place. Buy it as a boundary and you will be paying per text record for a control the platform vendor itself describes as probabilistic.

### Where does awareness training still earn its keep?

In phishing and in authorisation decisions, where a person is present and holds the choice. It has no reach into a step that runs without one.

## FAQ

### If nobody clicks, what sets the chain off?

Reading does. The agent consumes content that an outsider shaped, during a task the requester considers routine, and treats the wording it finds there as part of the job.

### Does one vendor's fix close this for us?

No. A fix addresses a specific route, and the public coverage disagrees about which routes were closed. Confirm the state of your own tenant and settings, then assume the class is still live.

### Is an injection classifier worth buying at all?

As an alarm and as telemetry, yes, after connector scope and egress limits are in place. Bought as a boundary it means paying per text record for a control the platform vendor itself describes as probabilistic.

### Where does awareness training still earn its keep?

In phishing and in authorisation decisions, where a person is present and holds the choice. It has no reach into a step that runs without one.


---
Source: https://agenticcyber.co/blog/zero-click-ai-agent-exploit-chains-what-agentflayer-teaches-defenders