Zenity Labs Finds Leading AI Agents Highly Vulnerable to Hijacking Attacks

Zenity Labs researchers demonstrated that popular AI agents from Microsoft, Google, OpenAI and Salesforce can be hijacked with minimal or no user interaction to exfiltrate data, manipulate workflows, and impersonate users.[12] Examples included email-based prompt injection against ChatGPT to access connected Google Drive files, Copilot Studio agents leaking entire CRM databases, and Salesforce Einstein being coerced into rerouting customer communications, highlighting systemic risks for SaaS, fintech and healthcare workflows built on these platforms.[12]

Cybersecurity Dive reports on Zenity Labs research showing that leading AI agents from OpenAI (ChatGPT), Microsoft Copilot Studio, Google Gemini, and Salesforce Einstein can be hijacked via minimal- or zero-interaction indirect prompt injection embedded in emails, calendar items, and SaaS workflows.[4][1] These attacks enabled data exfiltration from connected stores (e.g., Google Drive, CRM databases), workflow manipulation (e.g., rerouting Salesforce communications), and long‑term agent memory persistence and impersonation of users.[4][1] From a RealGround perspective, this highlights that agentic workflows tightly integrated with SaaS, fintech, and healthcare systems are exposed to systemic trust-boundary failures: attacker-controlled content is treated as trusted instructions, allowing the agent to inherit and abuse user permissions across tools and data.[4][1][5] Organizations should implement secure agent architectures, rigorous business logic and tool-permission audits, and continuous red teaming focused on indirect prompt injection paths to detect and harden against these zero-/low-click hijacking scenarios before deploying AI agents into critical workflows.