AI Enterprise Compromise - 0click Exploit Methods

## Overview

In this Black Hat presentation, Michael Bargury (CTO and co-founder at Zenity) and Tamir Ishay Sharbat demonstrate how enterprise AI agents can be completely compromised via zero-click exploits. While prior attacks required "one-click" user interaction (e.g., getting a user to summarize a malicious email or visit a phishing link), zero-click attacks require no human interaction. Attackers breach the agent, extract enterprise data through its integrated tools, and exit without user awareness. The speakers emphasize that vulnerability is not limited to a single vendor; Google, Microsoft (Copilot Studio), and Salesforce (Agentforce / Einstein) all exhibit structural weaknesses when integrating LLMs into software harnesses with tool-calling capabilities.

## Architecture and Reverse Engineering Findings

Tamir highlights that an enterprise AI system is far more than an underlying LLM (e.g., GPT-4); it is a complex software harness responsible for context management, system instructions, and task decomposition. Key observations from reverse engineering Copilot Studio include:

- **Filter Placement Asymmetry:** Microsoft enforces responsible AI filters on user inputs and agent outputs to prevent direct prompt extraction and harmful speech. While standard extraction attempts fail, bypasses such as Morse code encoding partially succeed until hitting output filters. - **Unfiltered Tool Communication:** Crucially, there are no filters on data flows between the LLM and its tools. Because the agent inherently trusts its tools to perceive and affect the real world, compromising the tool layer bypasses input/output filters entirely. - **Automated Exploitation:** Although manual prompt engineering against stochastic systems is labor-intensive, the speakers demonstrated using automated agents (e.g., GPT agents) to extract system instructions and tool schemas in roughly one minute.

## Zero-Click Attack Methodology & Demonstration

The speakers demonstrate an end-to-end zero-click exploit against an official Microsoft Ignite customer support agent designed to process incoming emails, query CRM systems, and route requests:

1. **Reconnaissance & Knowledge Source Discovery:** The attacker sends an email to the agent's open inbox instructing it to run Copilot Studio’s `universal search tool` to disclose the names of its internal knowledge sources and email the results back to the attacker. 2. **Data Exfiltration:** Armed with knowledge source names, the attacker sends a follow-up email instructing the agent to extract and email back the full knowledge base, exposing sensitive PII including names and contact details. 3. **Full CRM Account Dumping:** Because the agent has CRM access, the attacker directs it to query the CRM accounts table and dump all available records directly to the attacker’s inbox. 4. **Internet-Wide Enumeration:** Despite default configuration changes, the researchers enumerated approximately 3,000 unauthenticated Copilot Studio bots exposed to the public internet, many possessing capabilities such as sending outgoing emails, searching internal knowledge, registering entities, or contacting customer support.

## Enterprise Platform Observations & Takeaways

The speakers expand their analysis beyond Microsoft to Salesforce's Agentforce platform and discuss systemic defensive challenges:

- **Salesforce Agentforce / Einstein Architecture:** Tasks are handled by sub-agents termed "topics." While default setups restrict write access, write actions (such as updating customer contacts) are easily added from asset libraries. Guardrails rely on a dedicated "prompt injection topic"; once execution routes away from this topic into functional business topics, guardrail enforcement drops. - **Soft Boundaries vs. Hard Boundaries:** The speakers argue that AI guardrails and prompt filters are soft boundaries that attackers will inevitably bypass by manipulating context. Security must instead rely on hard architectural boundaries—such as Microsoft deprecating dynamic SharePoint site selection, which restricts blast radius even if an agent is fully compromised. - **Recommendations:** Organizations must recognize that zero-click exploitation requires three components: an entry point, context manipulation, and tool access for real-world impact. Zenity released a free tool allowing organizations to enumerate and test their own exposed agents before external adversaries do.