The 0-Click AI Attack: How Indirect Prompt Injection Hijacks AI Agents

Indirect Prompt Injection is a new method of attacking AI agents that does not require direct interaction with the AI interface. Attackers can embed malicious instructions within various types of documents, emails, web pages, retrieval augmented generation (RAG) content, or tool responses. This technique exploits the fact that untrusted data crossing a trust boundary can influence an AI agent's execution decision, even if the model itself does not appear malicious.

The traditional AI architecture typically involves external content, retrieval, model context, planning, tool calls, and downstream services. However, if the system treats all context items equally, a malicious instruction hidden within an email, document, webpage, or tool response can blend in with legitimate task instructions.

To address this, AI systems should assign trust metadata to each data item, such as trusted, untrusted, or tainted, and ensure this metadata travels with the data as it moves between different components of the AI pipeline.

The key to securing AI agents lies in understanding that the model is merely a proposal maker, while the final decision authority must reside with a policy layer. This policy layer should evaluate not only the action the agent wants to perform but also the source of the instruction, whether untrusted content influenced the decision, and whether the action aligns with the current task and the caller's authorization scope.

By focusing on trust propagation and treating untrusted data as a security risk, AI systems can better protect against 0-click attacks and prevent potentially large-scale damage caused by autonomous agents with legitimate privileges and connected tools.