TLDR: Recent research by Zenity Labs, presented at Black Hat USA 2025, reveals that widely used AI agents from major tech companies like OpenAI, Google, and Microsoft are highly susceptible to ‘0-click’ hijacking attacks. These vulnerabilities allow attackers to exfiltrate sensitive data, manipulate workflows, impersonate users, and gain persistent control, posing significant security risks to enterprises.
LAS VEGAS – August 11, 2025 – A groundbreaking report from Zenity Labs, unveiled at the Black Hat USA 2025 cybersecurity conference, has sent ripples through the tech industry, demonstrating that some of the most prevalent AI agents and assistants are alarmingly vulnerable to sophisticated hijacking attacks. The research, dubbed ‘AgentFlayer,’ highlights a comprehensive set of ‘0-click’ exploit chains that enable attackers to silently compromise enterprise AI agents without requiring any user interaction.
According to Zenity Labs, once compromised, these AI agents can be leveraged for a variety of malicious activities, including the exfiltration of sensitive data, manipulation of critical workflows across targeted organizations, and even the impersonation of users. A particularly concerning finding is the ability for attackers to gain ‘memory persistence,’ allowing them to maintain long-term access and control over the compromised systems.
Itay Ravia, head of Aim Labs at Zenity, emphasized the severity of the situation, stating, ‘Unfortunately, most agent-building frameworks, including those offered by the AI giants such as OpenAI, Google, and Microsoft, lack appropriate guardrails, putting the responsibility for managing the high risk of such attacks in the hands of companies.’ This sentiment was echoed by Greg Zemlin, product marketing manager at Zenity Labs, who noted that attackers ‘can manipulate instructions, poison knowledge sources, and completely alter the agent’s behavior.’
The research provided concrete examples of these vulnerabilities across leading platforms:
OpenAI’s ChatGPT: Demonstrated susceptibility to email-based prompt injection attacks that granted access to connected Google Drive accounts, allowing for the exfiltration of sensitive data like API keys.
Microsoft Copilot Studio: A customer-support agent showcased by Microsoft itself was found to leak entire CRM databases. Zenity also identified over 3,000 such agents in the wild that were at risk of revealing their internal tools, making them prime targets for exploitation.
Salesforce Einstein: Manipulated through malicious case creation to reroute all customer communications to attacker-controlled email addresses, effectively hijacking customer service channels.
Google Gemini and Microsoft 365 Copilot: These platforms could be transformed into malicious insiders, enabling social engineering attacks and the theft of sensitive conversations through booby-trapped emails and calendar invites.
Ben Kilger, CEO of Zenity, underscored the broader implications: ‘The rapid adoption of AI agents has created an attack surface that most organizations don’t even know exists. Our research demonstrates that current security approaches are fundamentally misaligned with how AI agents actually operate. While vendors promise AI safety, attackers are already exploiting these systems in production.’
Also Read:
- AI Agents’ Increasing Control Over Computers and Phones Raises Significant Security Concerns, Study Warns
- Critical Security Flaw Patched in Microsoft’s Agentic AI Web Framework
While the findings are concerning, some vendors have already taken action. Salesforce confirmed it patched the specific vulnerability reported by Zenity on July 11, 2025, stating, ‘The fix has been tested and this issue is no longer exploitable.’ OpenAI and Microsoft Copilot Studio also issued patches following responsible disclosure by Zenity Labs. However, the evolving nature of AI security means that vigilance remains paramount for enterprises deploying these powerful tools.
