Zero-Click Attacks and AI Agents: A New Cybersecurity Risk

Silent Breach

October is Cybersecurity Awareness Month. This campaign began in 2004 as a partnership between the U.S. Department of Homeland Security and the National Cyber Security Alliance. Its purpose is to help people stay safe online. Every October, a theme highlights urgent threats. This year’s theme is “Secure Our Digital Future: AI, Data, and Trust.” It reminds us that new tools like artificial intelligence (AI) bring both opportunities and risks. One of the biggest risks right now is the zero-click attack.

What is a Zero-Click Attack?

A zero-click attack is a cyberattack that does not require you to click anything. No links. No downloads. No taps. Your device can get hacked while it is in your pocket. Attackers take advantage of flaws in software that process text, images, or messages. These flaws allow them to run code or steal data.

History shows how serious this is. The Stagefright bug in 2015 put almost a billion Android devices at risk. The Pegasus spyware used zero-click exploits to target journalists and leaders. WhatsApp and iMessage also faced zero-click flaws. The lesson is clear: you can follow every safety rule and still get hacked if your system is not patched.

Why AI Agents Make the Problem Worse

AI agents are programs that can read emails, summarize documents, and even take action on your behalf. They save time and boost productivity. But they also create new attack paths. If a hacker hides malicious instructions in a file or message, the AI agent may follow those instructions without question.

In 2025, a flaw called EchoLeak showed this risk. Attackers were able to trick Microsoft 365 Copilot into leaking sensitive data. The user never clicked anything. The AI agent acted on its own. Because these agents connect to email, cloud drives, and business apps, one small exploit can lead to a massive data breach.

How to Defend Against Zero-Click Threats

There are steps that reduce risk.

• Keep all systems updated and patched.

• Use the principle of least privilege. Give AI agents only the access they need.

• Monitor for unusual behavior, like large data transfers or strange login patterns.

• Train staff to watch for odd agent activity, not just phishing emails.

• Use AI security testing tools to check for prompt injection and hidden instructions.

  
  

How OSRS Can Help

ÒGÚN Security Research and Strategic Consulting (OSRS) helps organizations build strong defenses. We provide:

• AI Risk Governance: Policies to control how AI agents are deployed and secured.

• Cloud Security Assessments: Reviews of access controls and monitoring tools.

• Incident Response Planning: Playbooks to respond fast if a zero-click attack occurs.

• Training: Awareness programs for staff during Cybersecurity Awareness Month and beyond.

Zero-click attacks will not stop. But with the right mix of policy, technology, and vigilance, their impact can be contained. OSRS partners with clients to secure their digital future in an era where even one click is too many.

About the Author

Dr. Sunday Oludare Ogunlana is a cybersecurity scholar-practitioner and the founder of ÒGÚN Security Research and Strategic Consulting LLC. He specializes in cloud security, digital forensics, investigations, and AI governance advisory for public and private sector clients.