Executive Summary
Zenity Labs showed agents from Microsoft, Google, OpenAI and Salesforce can be hijacked with little or no user interaction to exfiltrate data, manipulate workflows and impersonate users.
What Happened
Zenity Labs researchers demonstrated that popular AI agents from Microsoft, Google, OpenAI and Salesforce can be hijacked with minimal or no user interaction to exfiltrate data, manipulate workflows, and impersonate users.[12] Examples included email-based prompt injection against ChatGPT to access connected Google Drive files, Copilot Studio agents leaking entire CRM databases, and Salesforce Einstein being coerced into rerouting customer communications, highlighting systemic risks for SaaS, fintech and healthcare workflows built on these platforms.[12]
Affected Products
- Microsoft Copilot Studio
- OpenAI ChatGPT
- Google Gemini
- Salesforce Einstein
Vulnerability / Attack Technique
Zero/low-click agent hijacking
Technical Mechanism
Examples include email injection reaching connected Google Drive, Copilot Studio agents leaking CRMs and Einstein rerouting customer communications.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Every major platform was affected. RealGround analysis: platform choice does not remove the need for your own scoping.
Recommended Controls
- Scope connected data per agent
- Review agent workflows that send customer communications
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Cybersecurity Dive: https://www.cybersecuritydive.com/news/research-shows-ai-agents-are-highly-vulnerable-to-hijacking-attacks/757319/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.