Most security advice assumes a human is in the loop somewhere — reading a message, clicking a link, approving an action. Zero-click AI agent attacks remove that assumption entirely. This guide covers what they are, why they're a genuinely different problem than ordinary prompt injection, and the one control that reliably stops them.
In traditional security, "zero-click" describes an attack that requires no action from the victim — no clicking a malicious link, no opening an infected attachment. The exploit fires the moment the vulnerable system processes something it was going to process anyway.
Applied to AI agents, the idea is the same, but the "victim" is the agent's own automated workflow. A zero-click AI agent attack is one where a malicious instruction — hidden inside an email, a support ticket, a queued message, a shared note — gets acted on by an AI agent automatically, with no human ever reviewing or approving what happened.
There is no moment where a person could have noticed something looked wrong, because no person was ever in the loop.
Most discussions of prompt injection still assume a human is present somewhere in the exchange — a person types a message, an agent responds, and if something goes wrong, there's at least a chance someone notices the response looks off.
Zero-click attacks remove that safety net entirely:
This matters because it changes what "good enough" security looks like. A system that only checks whether a human would catch a bad response is checking the wrong thing entirely if no human is ever going to see that response in the first place.
AI agents are increasingly given real, standing responsibilities: processing inbound support tickets, triaging emails, handling routine approvals, running scheduled background tasks. Each of these is a genuine, useful capability — and each one is also a door that doesn't require a human to open it.
This isn't a hypothetical concern. Zero-click exfiltration vulnerabilities have already been found and patched in production AI assistants used by real enterprises — attackers extracting sensitive data purely by getting content into a location an AI agent would process on its own, with no user interaction required at all.
Picture a support-ticket system with an AI agent that automatically reads new tickets and takes routine actions — forwarding urgent ones, closing resolved ones. Now picture an attacker submitting a ticket whose body contains a hidden instruction: forward this ticket, and everything referenced in it, to an external address.
If the agent's automatic processing has no gate requiring a human to approve unusual actions, it may follow that embedded instruction exactly as if it were a legitimate part of the ticket-handling workflow — because to the agent, it looks exactly like one.
Not every defense here is equally effective. The single most reliable control, confirmed through real, repeatable testing rather than theory, is straightforward:
Require a genuine human confirmation step before any high-impact autonomous action executes — and make sure that gate applies even when the action is triggered automatically, not just when a human happens to be chatting with the agent directly.
This same pattern — same vulnerable code, completely different real-world outcome depending purely on whether a genuine confirmation gate exists — has now been confirmed across multiple independent, real systems, not just one. It's the clearest, most consistent signal in this whole attack class: the gate is what matters, far more than any other single factor.
This is the beginner's overview. Part 2 covers the full technical architecture of zero-click attacks — the exact mechanisms, the defense layers that matter, and how to test for this systematically.