Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-005

agent was the target · researcher disclosure · unreviewed

AgentFlayer: zero-click hijacks of enterprise agents, including a Copilot Studio service agent

Content an enterprise agent ingests — a shared document, an email, a web page — carries instructions that make it leak data or act on the attacker's behalf without the user's involvement. The research covered several products; the Copilot Studio customer-service agent was hijacked zero-click in the demonstration.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-08-06 Zenity Labs presents AgentFlayer at Black Hat USA; affected vendors issued fixes or guidance after coordinated disclosure · Zenity Labs T2

What defenders can take from it

  1. Any content an enterprise agent retrieves is an injection surface — shared docs and email included.
  2. Zero-click means there is no user to catch it; the control has to be on ingestion and egress, not a confirmation prompt.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 1

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.