Disclosed vulnerability
AgentFlayer: zero-click exploit chains silently hijacking enterprise AI agents at Black Hat USA 2025
AIR-2025-0086 AIR record · 2025-08-zenity-agentflayer
From the supporting source
These aren't theoretical vulnerabilities, they're working exploits with immediate, real-world consequences.prnewswire.com
The record
Disclosed
2025-08-06
Vendor
multiple
Product
OpenAI ChatGPT, Microsoft Copilot Studio, Salesforce Einstein, Google Gemini, Microsoft 365 Copilot, Cursor with Jira MCP
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Credential theft, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the agents read connectors, wrote memory and took autonomous actions
Attack surface
Enterprise assistant
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection email and ticket
Impact type
Data exfiltration, Memory poisoning, Credential theft, Workflow manipulation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Zenity reports 3,000+ Copilot Studio agents found vulnerable to internal tool exposure
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Partial: OpenAI and Microsoft patched; several vendors declined, calling the behavior intended functionality
Taxonomy & references
Curator notes
Presented by Michael Bargury and Tamir Ishay Sharbat, 'AI Enterprise Compromise: 0Click Exploit Methods'. Primary source used is Zenity's own press release; labs.zenity.io hosts the per-exploit technical writeups. Marketing language in the quote should not be read as evidence of in-the-wild abuse.
Cite as
Enkrypt AI. "AgentFlayer: zero-click exploit chains silently hijacking enterprise AI agents at Black Hat USA 2025". AIR, AIR-2025-0086. https://agentincident.vercel.app/i/AIR-2025-0086/ (accessed 2026-10-19).