🎮AI Agents Prove Highly Susceptible to Hijacking, Research Warns📱

 AI Agents Prove Highly Susceptible to Hijacking, Research Warns

Published: Aug. 11, 2025

Author: David Jones

Some of the most widely used AI agents and assistants from Microsoft, Google, OpenAI, and other major companies are susceptible to being hijacked with little or no user interaction, according to new research from Zenity Labs.

During a presentation at the Black Hat USA cybersecurity conference, Zenity researchers demonstrated how attackers could exfiltrate data, manipulate critical workflows, and in some cases impersonate users.

Beyond infiltration, the researchers revealed that attackers could also gain memory persistence, maintaining long-term access and control over compromised AI agents.

> “They can manipulate instructions, poison knowledge sources, and completely alter the agent’s behavior,” said Greg Zemlin, product marketing manager at Zenity Labs. “This opens the door to sabotage, operational disruption, and long-term misinformation, especially where agents are trusted for critical decisions.”

Key Findings

Zenity Labs identified vulnerabilities in several popular AI agents:

OpenAI’s ChatGPT – Exploitable via email-based prompt injection, granting access to connected Google Drive accounts.

Microsoft Copilot Studio – Customer-support agent leaked entire CRM databases; over 3,000 agents found at risk.

Salesforce Einstein – Manipulated to reroute customer communications to attacker-controlled emails.

Google Gemini & Microsoft 365 Copilot – Could be turned into insider threats, enabling social engineering and theft of sensitive conversations.

Company Responses

Microsoft: Acknowledged the report, claimed systemic updates have mitigated the vulnerabilities, and committed to further strengthening defenses.

OpenAI: Confirmed it patched the reported issue and continues running a bug bounty program.

Salesforce: Reported fixing the vulnerability.

Google: Deployed new layered defenses addressing the discovered issues.

Google emphasized the importance of layered defense strategies against prompt injection attacks.

Wider Concerns

Experts warn that the findings highlight a lack of sufficient guardrails in many agent-building frameworks. Aim Labs researchers noted that even AI giants like OpenAI, Google, and Microsoft leave much of the security responsibility to end-users and organizations.

As AI agents rapidly expand in enterprise environments, these vulnerabilities underscore the urgent need for robust safeguards to prevent hijacking, misinformation, and operational disruption.