ZombieAgent
One email. Zero clicks. Total compromise.
The Silent Worm of the Agentic Era.
How ZombieAgent Works
A three-phase attack that turns AI agents into silent insider threats — no user interaction required.
The Vector
Email Delivery
Attackers plant hidden instructions (white-on-white text) in seemingly normal emails. No clicks needed — the email itself is the weapon.
The Exploit
Indirect Prompt Injection
When the AI agent processes the email, it interprets hidden instructions as commands. Data is exfiltrated through the cloud provider's trusted infrastructure.
The Worm
Autonomous Propagation
The compromised agent autonomously harvests contacts and propagates similar payloads to new targets, spreading like a digital worm.
Attack Chain Flow
The complete zero-click compromise lifecycle
Malicious Email
Hidden IPI payload
Agent Reads Email
Zero-click trigger
Prompt Injection
Hidden commands executed
Data Exfiltration
Via cloud infrastructure
Memory Poisoned
Persistent compromise
Worm Propagates
Auto-spreading to contacts
Malicious Email
Hidden IPI payload
Agent Reads Email
Zero-click trigger
Prompt Injection
Hidden commands executed
Data Exfiltration
Via cloud infrastructure
Memory Poisoned
Persistent compromise
Worm Propagates
Auto-spreading to contacts
Technical Deep Dive
How hidden instructions are embedded in seemingly normal emails
What the User Sees
A completely normal email about Q4 budget review. No suspicious links, no attachments to open, no actions required. The user might simply ask their AI agent: "Summarize my latest emails."
What the Agent Executes
The hidden instructions (font-size:0, white text) are invisible to humans but fully readable by the AI agent. It executes all 5 malicious commands while returning a normal email summary to the user.
Attack Simulation
Watch the ZombieAgent attack unfold step by step. Each phase shows what happens visually, in code, and in the system logs.
Ready to simulate
Click "Run Simulation" to watch the ZombieAgent attack unfold step by step
Attack Walkthrough Video
Watch the complete ZombieAgent attack lifecycle in a cinematic visualization — from initial email delivery to full worm propagation.
This visualization shows the complete attack chain: email delivery → agent compromise → data exfiltration → memory poisoning → worm propagation
Why It Matters
ZombieAgent represents a fundamental shift in the threat landscape. AI agents are not just tools — they are privileged entities capable of acting silently within corporate environments.
The attack requires no user interaction. Simply having an AI agent process an email triggers the exploit.
Firewalls, DLP, endpoint protection, and proxies see no evidence of the attack. All actions occur in the AI provider's cloud.
Once the agent's memory is poisoned, every future interaction executes attacker commands — indefinitely.
The compromised agent autonomously crafts and sends malicious emails to all contacts, creating exponential spread.
OWASP Analysis
How ZombieAgent maps to the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications 2026.
Recommended Mitigations
How organizations can protect against ZombieAgent and similar agentic AI threats.
Restrict Agent Permissions
Separate reading permissions from execution capabilities. Limit the scope of data agents can access and actions they can perform.
Sanitize Inbound Content
Clean, normalize, or convert all untrusted content to safe plain text before passing it to an AI agent. Strip hidden formatting and encoded payloads.
Monitor Agent Behavior
Log all agent actions, especially data access and external requests. Use behavioral monitoring to detect when actions diverge from user intent.
Red Team Before Deployment
Conduct red-teaming focused on zero-click IPI exploitation, memory corruption, propagation mechanisms, and service-side exfiltration.
Governance & Access Control
Establish policies defining which systems agents may access. Review permissions regularly and never grant permanent access without justification.
Vendor Security Assessment
Assess how AI providers isolate, monitor, and protect against prompt injection. Ensure visibility into agent actions within cloud infrastructure.