Zero-Click Prompt Injection

Classic phishing needs a user to act. Zero-click prompt injection only needs the AI to read attacker-controlled content during its normal work, after which it may leak data or take actions on the attacker's behalf.

Typical delivery vectors include:

• Inbound email: Messages an assistant summarizes or indexes automatically.
• Shared documents: Files placed in drives or workspaces the AI searches.
• Calendar invites: Event descriptions processed by scheduling assistants.
• Web content: Pages an agent visits while researching a task.
• Tool outputs: Responses from MCP servers or APIs that contain instructions.

High-profile cases such as EchoLeak in Microsoft 365 Copilot showed that zero-click injection can exfiltrate sensitive data through features users never touch. As agents gain more autonomy, the same pattern can trigger actions, not just leaks.

Defenses focus on treating all retrieved content as untrusted, inspecting it before the model acts, and blocking risky output channels such as auto-loaded images and links.

How PointGuard AI Helps

PointGuard AI AI Runtime Guardrails inspect content and tool outputs for injected instructions before agents act on them, and AI Data Protection blocks sensitive data from leaving through hidden channels. Together they stop zero-click attacks at both the input and the output.

Learn More

• Greshake et al.: Indirect Prompt Injection (arXiv:2302.12173)
• OWASP Top 10 for LLM Applications
• OWASP Top 10 for Agentic Applications