The Agent Reads the Lead — Zero-Click Exfiltration Through the Bank's Internal AI Agents — severe-but-plausible scenario — ITOL

Vector: Cyber · Severity: severe

The bank's employee-facing AI agents read whatever lands in business data: web lead forms, inbound email, shared documents, calendar invites. An attacker plants instructions in a public form. When a relationship manager asks the agent a routine question, the agent reads the poisoned record and pulls the accounts table. It then renders a tiny image whose address carries the rows out through DNS (the internet's address lookup). Nobody clicks. Data-loss tools see nothing. The attacker never logs in.