Table of Content
The Agent Is the New Preview Pane: When AI Opens the Attachment Nobody Clicked
-
November 13, 2026
-
Kitecyber | Data & Gen AI Security
For years, “zero-click” meant a document that exploited the software rendering it before the user decided anything. AI agents widen that idea: they open, read and act on external content automatically, at a scale no person could match. The question is no longer only “did someone click?” but “what opened this, and what did it do next?”
CrowdStrike’s analysis of Microsoft’s November 2026 Patch Tuesday (10 November) found 1,252 CVEs, one exploited zero-day and 68 Critical vulnerabilities. One pattern stood out for the third month in a row: eight Critical remote code execution vulnerabilities in Outlook and Word that can be triggered through the Preview Pane, with CVSS scores from 7.5 to 8.8. The preview pane is dangerous for a simple reason. Content gets parsed before a human has judged whether it is safe.
That is exactly how AI assistants and agents handle content by design.
Agents read everything, automatically
- 1. Instruction-borne attacks. Microsoft described this in October when it introduced trust-aware controls in Microsoft 365 Copilot: an ordinary business email with embedded instructions can influence the model when it is pulled into context. Its answer is a deterministic layer that labels content as trusted or untrusted by policy, with email from outside the organization as a starting example. That is a sound design, and it shows that the source of content now matters as much as the content.
- 2. Parser-borne attacks. Desktop agents that work through local applications, convert files or extract text run the same document-handling code paths a human would. They just do it on more files, faster, and without hesitation. A malicious attachment no employee would open can still be opened by an agent working through a folder.
Provenance has to travel with the content
- Origin of the file. Downloaded from the web, saved from an external email, synced from a partner share, or created locally.
- Which process opened it. The user in Word, or an agent, script or helper process acting with no one at the keyboard.
- What happened right after. New processes, network connections to unfamiliar destinations, or sensitive files read in the same session.
- What data was nearby. On-device classification shows whether the agent that just read an untrusted attachment also had customer data or credentials in reach.
A practical checklist
- 1. Patch the preview-pane RCEs now and treat agent-driven document processing as part of the same attack surface.
- 2. Inventory every assistant and agent that reads mail, downloads or shared folders, not only the sanctioned copilot.
- 3. Treat external content as untrusted by default for agents, and limit which agents can process it unattended.
- 4. Watch the sequence, not the single event: untrusted content opened by an agent, then sensitive reads, then outbound transfer.
- 5. Block outbound transfer of classified data by agents that recently processed untrusted content, rather than relying on a warning nobody sees.
Where Kitecyber fits
Book a Kitecyber walkthrough at kitecyber.com to see AI agent activity and data movement across your endpoints.
Ajay Gulati
Ajay Gulati is a passionate entrepreneur focused on bringing innovative products to market that solve real-world problems with high impact. He is highly skilled in building and leading effective software development teams, driving success through strong leadership and technical expertise. With deep knowledge across multiple domains, including virtualization, networking, storage, cloud environments, and on-premises systems, he excels in product development and troubleshooting. His experience spans global development environments, working across multiple geographies. As the co-founder of Kitecyber, he is dedicated to advancing AI-driven security solutions.
