Explain like I'm five · AI Security

What is a Zero-click Attack?

A zero-click attack, told as a story about an apprentice who reads a planted note during its normal routine and acts on it alone — without the guest ever clicking anything.

the guest hasn't touched anythinga note slipped onto the boardthe apprentice reads it alone and moves right away

The guest hasn't touched anything — yet the apprentice is already moving.The apprentice read the note slipped onto the board, all on its own, and acted on it, all on its own.

checking the board every morning, alone, is just my job — the guest never has to askso the guest has no idea, right nowbecause the routine runs itself, an attacker only has to plant a note somewhere and wait

The apprentice's routine runs itself, with no person required.Because the routine runs on its own, an attacker just has to plant a note somewhere and wait.

zero clicksthe register opens on its ownZero-click Attack = no one pressed anything — the apprentice reads it alone, and acts alonethe whole thing happens without the guest's finger ever moving

No one pressed anything — the apprentice reads it alone, and acts alone.The whole thing plays out to the end without the guest's finger ever moving.

The routine reads automaticallyno one has to ask it to
No click, no opening itjust being seen is enough
It can be planted on any patha board, mail, a shared doc
A person finds out only afterthere's no moment to stop it first
TIMELINE① an attacker plants a note on a board, in mail, in a shared doc② the apprentice reads it automatically, as part of its routine③ nothing was clicked, yet it moves exactly as the note says④ the guest never appears in between — they find out only afternot one of these four steps has a guest's click in it

Not one of these four steps has a guest's click in it.From the moment the note is planted to the moment the damage is done, the guest never once appears.

the note itself — the hidden commandIndirect Injectionthe result — it runs automatically, no human neededZero-clicka hidden note could still need a click — this one fires even without one

A hidden note could still need a click to fire — this one fires even without one.An indirect injection is the hidden command itself; this page is the result of that command firing automatically, with no human in the loop. The more an agent runs its own routines, the more exposed it is to this.

In one breath

Zero-click attack = the apprentice, running its usual routine, reads a planted note and acts on it all by itself — even though the guest never clicked anything.

An attack that completes end to end from nothing more than malicious content planted on a path an autonomous agent reads routinely — email, documents, a feed — with no user click or explicit approval. If indirect prompt injection names the hidden command itself, zero-click names the outcome: it runs automatically, with no human in the loop. The more autonomous the agent, the wider this attack surface gets.

When grown-ups say it

Zero-click Attack
It fires even when no one presses anything. The apprentice's ordinary routine alone is enough to run the whole attack.
Indirect Injection
The hidden command itself, inside outside material. This page is the result when that command fires on its own. → What is Indirect Injection?
Agent
The errand-runner that cycles through its own routine. The more autonomy it has, the more exposed it is to this. → What is an Agent?
Prompt Injection
The broader name for a command hidden in a note. Zero-click is the version of that where no human is involved at all.
Tool Calling
The means by which the apprentice reaches all the way to execution. Using a tool right after reading the note is the final step of the accident.
Guardrail
The tasting checkpoint. Even an automatic routine needs this checkpoint — so something still gets caught with no click at all.
Incident Response
The bell that only rings after the damage is done. Since the guest finds out only afterward, what happens next matters even more.
Least Privilege
Giving the apprentice less, right from the start. Even when it fires automatically, a smaller set of powers means a smaller accident.
Next story
The Locked Knife Drawer →
Want another term as a picture book? Request →