{
 "id": "TR-2026-005",
 "status": "published",
 "title": "AgentFlayer: zero-click hijacks of enterprise agents, including a Copilot Studio service agent",
 "date": "2025-08-06",
 "window": "Presented at Black Hat USA, 6 Aug 2025; vendor fixes and guidance followed disclosure",
 "ai_role": "target",
 "category": "red_team",
 "summary": "Content an enterprise agent ingests — a shared document, an email, a web page — carries instructions that make it leak data or act on the attacker's behalf without the user's involvement. The research covered several products; the Copilot Studio customer-service agent was hijacked zero-click in the demonstration.",
 "attacker": {
  "description": "Security researchers (Zenity Labs), proof of concept at Black Hat USA 2025"
 },
 "defender": {
  "description": "Microsoft and other named vendors — fixes and guidance after coordinated disclosure"
 },
 "scale": "CRM/customer data and connected-tool actions in the demonstrated agents",
 "impact": "Agent hijacked without user interaction",
 "tactics": [
  "TA0001",
  "TA0009",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-08-06",
   "text": "Zenity Labs presents AgentFlayer at Black Hat USA; affected vendors issued fixes or guidance after coordinated disclosure",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "Any content an enterprise agent retrieves is an injection surface — shared docs and email included.",
  "Zero-click means there is no user to catch it; the control has to be on ingestion and egress, not a confirmation prompt."
 ],
 "models_named": [],
 "related_agents": [
  "microsoft-microsoft-copilot-studio"
 ],
 "vendor_response": "Vendor fixes and guidance after coordinated disclosure (per the Zenity write-up)",
 "sources": [
  {
   "title": "AgentFlayer: 0-click exploit methods",
   "url": "https://www.zenity.io/research/agentflayer-vulnerabilities",
   "outlet": "Zenity Labs",
   "date": "2025-08-06"
  }
 ],
 "reviewer": null,
 "checked_on": null
}