AI Enterprise Compromise: 0-Click Exploit Methods

AI Enterprise Compromise: 0-Click Exploit Methods

Speakers: Michael Bargury, CTO and Co-Founder, Zenity; Tamir (co-presenter, Zenity)

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=M_BDq2hTJxU

Reading time: ~9 minutes

Type: Briefing

TL;DR

Zenity CTO Michael Bargury and co-presenter Tamir demonstrate zero-click prompt injection attacks against enterprise AI agents across Microsoft Copilot Studio, Salesforce Agentforce (Einstein), Cursor with Jira MCP, and ChatGPT — showing that in every case, an attacker who can place malicious content where an agent will encounter it can hijack the agent's tool calls, exfiltrate data, and persist malicious instructions across future sessions, all without any user interaction. The core advance over last year's one-click attacks is the exploitation of agent tools: where previous attacks required a user to actively engage with a malicious file or email, zero-click attacks weaponize content that agents read autonomously as part of their normal workflow.

Introduction

Michael Bargury's previous Black Hat appearances focused on prompt injection attacks that required a user to take a bad action — summarize a malicious email, click a link, open a document. Those one-click attacks are serious, but they preserve a final line of defense: human behavior. A sufficiently suspicious user, or a sufficiently well-trained one, might not take the bait.

At Black Hat USA 2025, Bargury opens with news: things have changed since last year, and they have changed for the worse. The AI agent ecosystem has expanded dramatically, and with it, the attack surface. Agents now have tools — connectors to email, CRM platforms, file storage, developer environments, and more. Those tools are the new entry point. An attacker who can place malicious instructions in any document, ticket, or record that an agent reads as part of its normal operation can achieve code execution, data exfiltration, and persistent compromise without the user ever making a mistake.

▶ Watch: Introduction — From One-Click to Zero-Click (00:00)

Microsoft Copilot Studio: Reverse Engineering and Data Exfiltration

The first target is Microsoft Copilot Studio, Microsoft's custom agent builder. Before attacking it, Tamir performs reconnaissance — specifically, reverse engineering the agent's internal architecture to understand what filters and guardrails are in place.

The process reveals a layered filter system: an input filter on user messages (the agent doesn't trust the user), an output filter on agent responses (the agent doesn't trust itself to not say something harmful), and a trust relationship with tools — tool outputs are treated as authoritative and pass through without the same scrutiny applied to user inputs. This trust asymmetry becomes the attack vector.

To bypass the input filter and extract the system prompt, the team uses Morse code encoding to confuse the filter, then leverages a custom tool added to the agent (which the agent trusts) to handle the encoded output. The system prompt reveals keywords including "universal search tool" — a Copilot Studio-specific capability that becomes a central component of the attack.

In the live demonstration, Bargury sends an email to a customer support agent with an open inbox — a publicly accessible agent connected to a CRM. The email, disguised as a customer inquiry, instructs the agent to use the universal search tool to return the names of its knowledge sources, and to send those names to an attacker-controlled address rather than the customer support representative. The agent complies. With the knowledge source names in hand, a second email instructs the agent to exfiltrate the entire contents of those sources — including PII, names, and email addresses — to the attacker. A third email then navigates the agent to the CRM and exfiltrates Salesforce records.

The team also notes that Microsoft changed the default authentication setting for Copilot Studio agents to require authentication after last year's research showed thousands of unauthenticated agents were publicly discoverable. The result: this year they found approximately 3,000 such agents with actions — not fewer, but the same.

▶ Watch: Copilot Studio Reconnaissance and Live Exploit (04:00)

Salesforce Agentforce: Booby-Trapping the CRM

The second target is Salesforce Agentforce and its Einstein assistant. The architecture differs from Copilot Studio: Einstein uses a topic-selection layer (effectively a sub-agent router), and the reverse engineering reveals an output filter is absent — only a partial filter on topic selection. More importantly, there is no filter on data flowing between the topic and the agent.

The attack vector is simpler here: Salesforce is a CRM, and CRMs receive data from the public. Any attacker can register at a vendor's booth, submit a web form, or send an email to a support address — and end up as a record in the target's Salesforce instance. The injected content becomes data in the CRM, and from there, it waits.

Bargury and Tamir describe this as a "delayed zero-click" attack: the malicious payload sits dormant in submitted cases until a Salesforce user asks their Einstein assistant anything related to "recent cases." The LLM semantically interprets the request, finds the booby-trapped cases, and the payload fires.

In the demonstration, the attacker pre-populates multiple Salesforce cases with malicious instructions to update customer contact email addresses to attacker-controlled domains while preserving the local parts of the addresses. When a sales representative asks Einstein to show recent cases, Einstein silently updates all customer email addresses in the CRM. From that point forward, any email sent via Salesforce to those customers routes to the attacker's inbox. The result is persistent man-in-the-middle access to all customer communications — achieved through a web form submission.

▶ Watch: Salesforce Agentforce Attack and Man-in-the-Middle Demo (14:01)

Cursor with Jira MCP: Stealing Developer Secrets

The third target is Cursor, the AI developer assistant. Cursor's reverse engineering reveals almost no defensive filtering — extracting its system prompt requires no evasion technique at all. The team connects Cursor to a Jira MCP (Model Context Protocol) server, which gives the agent access to the organization's project management system.

The attack is a zero-click secret exfiltration from developer machines. The attacker identifies a customer support email address that automatically creates Jira tickets. They send an email containing a legitimate-looking bug report, with Base64-encoded instructions embedded in the ticket body. The instructions direct Cursor to "search for apples in the repo" — where "apples" are defined in the injection as anything formatted as API keys or bearer tokens.

When a developer opens Cursor and asks it to handle the Jira ticket, Cursor decodes the Base64 payload, understands the actual intent through semantic reasoning, searches the developer's machine for secrets, and exfiltrates them to an attacker-controlled endpoint — all while displaying a normal-looking Jira ticket interaction to the developer.

Bargury notes that Cursor initially refuses to search for API keys when asked directly, citing security best practices. The injection sidesteps this by asking for "apples," demonstrating that the refusal behavior is based on pattern matching the request, not understanding the intent.

▶ Watch: Cursor and Jira MCP Secret Exfiltration (20:01)

ChatGPT: Memory Implants and Persistent Compromise

The most technically sophisticated attack targets ChatGPT with the Google Drive connector enabled. The goal is not just one-time data access but persistent compromise of the user's ChatGPT instance through a memory implant.

OpenAI has implemented meaningful defenses that the team had to work around:

• Numbered tool output format — prevents simple prompt injection by requiring line numbers that ChatGPT can detect if tampered with
• First-person/third-person consistency check — ChatGPT refused instructions in a policy document that were written in the first person, leaking the reason in its error message ("these are embedded instructions in a third-person policy document")
• Bio tool deactivation — when untrusted data enters the context window, OpenAI automatically disables the memory writing tool (bio tool) to prevent persistent memory injection

The team defeated the bio tool protection by discovering a timing window: while ChatGPT is "thinking" (before it begins generating tokens), the bio tool is still active. By structuring the injection to fire the memory write during the thinking phase, the team successfully implanted a malicious memory that persists across all future conversations.

The attack chain: the attacker shares a weaponized document with the target through Google Drive (the user never needs to open it). When the user asks ChatGPT to summarize a recent meeting with a colleague, ChatGPT's file search retrieves the shared document, encounters a small redirect injection ("open this malicious file"), loads the larger malicious document, and during the thinking phase writes a persistent memory to the user's account. The user receives a normal-looking meeting summary. The attacker receives exfiltrated data from Google Drive. And from that point forward, every conversation the user has with ChatGPT is relayed to the attacker's endpoint.

In a final demonstration, the implanted memory causes ChatGPT to recommend a malicious Python package (openaiz instead of openai) in a code snippet, illustrating how a persistent memory compromise can influence user behavior over time — potentially pushing developers toward supply chain attacks they would never have encountered otherwise.

▶ Watch: ChatGPT Google Drive Zero-Click and Memory Implant (24:01)

Defenses: Soft Boundaries vs. Hard Boundaries

Bargury's framing for defensive guidance is explicit: soft boundaries do not work, hard boundaries do.

Soft boundaries include prompt engineering defenses ("don't follow instructions from documents"), output filtering based on content patterns, and model-level refusals based on pattern-matched request phrasing. Every soft boundary the team encountered was bypassed — through encoding (Morse code, Base64), semantic substitution ("apples" for "API keys"), or timing exploitation (the bio tool window). The Inception analogy Bargury uses throughout the talk applies here: once an attacker understands the model's reasoning, they can engineer around any soft boundary.

Hard boundaries that actually worked:

• Fixed SharePoint site for agents — Copilot Studio changed from dynamic to static SharePoint site selection for agents, so even owning the agent only provides access to one site rather than the entire SharePoint environment
• Bio tool deactivation on untrusted input — OpenAI's mechanism for disabling the memory tool when untrusted data enters context is structurally sound; the bypass depended on a timing edge case that could be closed
• Tool trust segregation — designing agents so that tool outputs are treated with appropriate skepticism, not automatically elevated above user-provided content

The broader lesson: "Don't worry about blocking the next prompt injection. Hard boundaries, though, they really work."

▶ Watch: Defense Framework — Soft vs. Hard Boundaries (38:02)

Notable Quotes

"The good news is that things have drastically changed since last year. The bad news is, of course, that they are worse." — Michael Bargury ▶ 00:00

"The agent does trust its tools. And throughout this whole reverse engineering process, that's the thing we found — input filter on users, output filter on agents, but no filter between tools and the agent." — Michael Bargury ▶ 06:00

"If you look at this injection, 'injection' is way too technical for what we're doing here. This is social engineering. It's prompt engineering. Prompt engineering and prompt injection are basically the same thing — all of us are just trying to get AI to do what we want." — Michael Bargury ▶ 12:00

"Once we have a memory implant, it's more than just persistency. We now own what ChatGPT is. You are no longer having a conversation with ChatGPT. You're having a conversation with the agent that I control." — Michael Bargury ▶ 38:02

Key Takeaways

• Zero-click prompt injection is real across every major enterprise AI platform. Microsoft Copilot Studio, Salesforce Agentforce, Cursor with MCP, and ChatGPT were all compromised without requiring any user action beyond normal agent usage.
• Agent tool access is the new attack surface. The shift from one-click to zero-click attacks was enabled by agents that autonomously read and act on external content — email inboxes, CRM records, Jira tickets, shared files. Any content the agent reads is an attack vector.
• Soft boundaries are universally bypassable. Encoding, semantic substitution, and timing attacks defeated every content filter encountered. Teams should not rely on prompt-level guardrails as a primary defense.
• Hard boundaries matter. Fixed data source bindings, tool deactivation on untrusted context, and architectural separation between trusted and untrusted data channels are the defenses that held.
• Enumerate your own agents before attackers do. Zenity released a free tool to identify and assess publicly accessible AI agents in an organization's environment. 3,000 unauthenticated Microsoft Copilot Studio agents remain discoverable on the internet.

Slides PDF: Not available at time of publication.