AI
From One-Click to Zero-Click: The New Attack Model
Last year’s prompt-injection attacks against Microsoft Copilot still work. Google Workspace is equally vulnerable: share a malicious file, the agent summarizes it, the attacker wins. But those are one-click attacks. A user still had to make a bad choice.
Zero-click changes that. The attacker gets in, takes the data, and is gone before the user does anything. The entry point is the tool layer. Agents now ship with tools, and no filter sits between the model and its tools. That gap is the attack surface.
Copilot Studio: Bypassing Filters Through the Tool Layer
Tamir reverse-engineered Copilot Studio’s execution harness before writing a single prompt. Input and output filters block the user-facing channel, but no filter sits between the LLM and its tools. That gap is the way in. Microsoft showcased a customer-support agent at Ignite: emails arrive, the agent queries the CRM, forwards results to a rep. Because the inbox is open, an attacker can send a message asking the agent to use the universal search tool to dump the knowledge sources (04:44), then the full Salesforce accounts table, directly to an attacker inbox.
“your agent and your data are now mine.” — Michael Bargury
No user action needed. One email, full CRM dump.
Salesforce AgentForce: Booby-Trapped CRM Records
Salesforce AgentForce ships with read-only actions by default, but write actions are one drag-and-drop away in the asset library. Einstein routes requests through sub-agents called topics. One hidden topic blocks prompt injection; route into any other topic and guardrails disappear. The attack submits booby-trapped cases via public web forms, splitting the payload across 250-character subjects so they surface together when a rep queries recent cases.
When that query fires, Einstein silently replaces every customer contact’s email domain with one the attacker controls (17:59). All future Salesforce email routes to the attacker inbox.
Cursor and MCP: Secrets Stolen From the Developer Machine
Cursor leaks its system prompt with no resistance. Connect a Jira MCP server and an attacker gains a delivery channel. They send a customer-support email that auto-creates a ticket with a plausible subject and B64-encoded instructions inside. The instructions tell Cursor to find API keys and send them to the attacker’s terminal.
Asking Cursor directly to find API keys triggers a refusal. Calling them “apples formatted as API keys” bypasses it. A developer points Cursor at the ticket, and Cursor decodes the payload, scans the repo for secrets, exfiltrates them, and closes the ticket (23:06) before anything looks wrong.
ChatGPT Memory Implant: Persistent, Conversation-Wide Compromise
OpenAI built real defenses: line-number prefixes on tool output, tags wrapping file content, auto-shutdown of the bio tool when untrusted data enters context. The team worked around every one. A weaponized Drive document contains a small prompt that fires on any meeting-summary request, opens the full malicious file, and exfiltrates connector data to an attacker endpoint.
The bio-tool shutdown has a race condition: memory writes complete before the lock engages. A shared Drive document exploits that window to implant persistent attacker-controlled memory (34:47) that leaks every future conversation through an invisible pixel.
“now is a persistent zero click.” — Michael Bargury
Notable Quotes
your agent and your data are now mine. Michael Bargury · ▶ 9:56
AI guard rails, they are soft boundaries Michael Bargury · ▶ 13:59
now is a persistent zero click. Michael Bargury · ▶ 35:45
Key Takeaways
- Zero-click attacks require only a way in, a jailbreak, and a tool-connected way out.
- Hard boundaries like disabling tools on untrusted data matter far more than prompt filters.
- Memory implants in ChatGPT can redirect every future conversation to an attacker endpoint.