Zero-click attack
Also called: zero-interaction
A zero-click attack compromises a target without them doing anything beyond normal use: no link to click, no file to open, no prompt to approve. In AI systems, an agent that reads incoming email, tickets or repos on its own can be hijacked the moment malicious content arrives.
How it works
The attacker sends content to a channel an AI agent processes automatically. The agent reads it, follows the embedded instructions and acts, for example by searching for secrets and sending them out, before any human looks. Automation is what turns injection into zero-click.
How to defend
Be careful about which inbound channels agents process unattended, require approval before agents act on untrusted input, and limit what autonomous agents can reach and send.
Real cases 2 stories
MED
Attack · Zenity Labs
SalesBleed: zero-click CRM data theft through Salesforce AgentforceSalesBleed is a Zenity Labs attack in which one web form lead carrying a prompt injection made Salesforce Agentforce leak Accounts data through DNS with zero clicks. Salesforce hardened its Trusted URLs filter in August 2026.
HIGH
Vulnerability · AIR Security
Plugin4Shell: zero-click plugin RCE in four AI coding agentsPlugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.