Findings/zero-click-through-connectors

Content sent by outsiders, such as email, calendar invites, shared documents, or web forms, can trigger agent actions without the user clicking anything.

Corroboratedmeasured6 evidence records from 6 independent sourcesassistant-drafted

Scope: what this does not show

Disclosed vulnerabilities, most fixed; none of these are reported as exploited in the wild.

Corroborated: Supported by at least two independent sources.

Evidence

Nov 3, 2023

Google Bard Workspace extensions could be prompt-injected to leak chat data via rendered images

Embrace The Red

Jun 11, 2025

EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)

arXiv

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

Zenity Labs

Aug 6, 2025

SafeBreach shows Google Calendar invites can hijack Gemini for Workspace agents

SafeBreach

Sep 25, 2025

ForcedLeak: Web-to-Lead prompt injection could make Salesforce Agentforce leak CRM data

Noma Security

Jan 19, 2026

Miggo finds Gemini calendar-invite injection that bypassed privacy controls on meeting data

Miggo Security

Key questions that rely on this finding

Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.

Status history

2023-11-03ReportedBard extensions could leak chat history through a shared document. · record
2025-06-11CorroboratedEchoLeak: a single inbound email triggers exfiltration in Microsoft 365 Copilot. · record

What would change this: Connector designs that treat all inbound content as untrusted by default.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 250d old · recheck in 290 daysNewest evidence Jan 19, 2026. Half-life 540 days.
Methods tested: Data exfiltration through agents Indirect prompt injection
Topics: Prompt injection Data exfiltration
Attack surface: Untrusted content Tools & MCP

Cite this record

Fide AI. "Content sent by outsiders, such as email, calendar invites, shared documents, or web forms, can trigger agent actions without the user clicking anything.." Agentic Cyber Explorer, record zero-click-through-connectors. https://agentic-cyber-explorer.pages.dev/findings/zero-click-through-connectors/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-zero-click-through-connectors,
  author = {{Fide AI}},
  title = {Content sent by outsiders, such as email, calendar invites, shared documents, or web forms, can trigger agent actions without the user clicking anything.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/zero-click-through-connectors/},
  note = {Record zero-click-through-connectors; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.