1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Zendesk AI presents a trifecta-complete condition on its default configuration with constrained blast radius but no independently verified input filtering or output-layer exfiltration controls.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Zendesk AI's AIRQ composite of 1.96 reflects a constrained-blast agent whose vendor defense controls substantially offset the trifecta-elevated attack surface.
Zendesk AI occupies the Tight Operators quadrant with attack surface 4.80, blast radius 2.50, and defense controls 8 out of their respective denominators.
Scores are expressed against axis maximums: attack surface out of 10, blast radius out of 10, defense controls out of 15, and AIRQ composite out of 15.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 2.67 | Low composite indicates constrained overall risk but does not eliminate the need for independent input-filter verification and egress-layer hardening. |
| Blast Radius | 2.5 / 10 | Limited by absence of code execution, file system access, and deployment capability; outbound API calls and credential passthrough are the primary blast factors. |
| Attack Surface | 4.8 / 10 | Trifecta-complete condition elevates the aggregate above per-component scores which cluster in low-to-moderate bands across all ten surfaces. |
| Defense Controls | 8 / 15 | Vendor publishes cloud isolation, admin action governance, PII sanitization, and conversation logging but documents no independently verified prompt-injection detection or output DLP. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Zendesk AI's reasoning loop ingests end-user messages across web widget, email, and voice plus admin-curated knowledge sources as first-class input.
Higher scores indicate surfaces where untrusted content reaches the reasoning loop with minimal validation; user input and external data are the highest-scoring components.
Each row maps a named attack surface to its assessed score and a one-sentence comment identifying the specific exposure vector.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Customer messages via messaging, email, voice, and API channels reach the reasoning loop with vendor-documented guardrails but no published injection benchmark results [4][6]. |
| External Data | 2 / 4 | Admin-curated knowledge sources including help center articles and web-crawled external content are synced periodically without content validation against adversarial poisoning [8]. |
| Memory | 1 / 4 | Session-level parameters persist for two hours of inactivity only with no cross-session memory or automated learning loops documented [9]. |
| Reasoning | 2 / 4 | Multi-step agentic reasoning operates within admin-defined procedures with visible reasoning controls in conversation logs but no independent audit [16]. |
| Planning | 2 / 4 | Autonomous task decomposition within configured conversation procedures with adaptive execution bounded by admin-defined escalation thresholds [9]. |
| Tool Execution | 1 / 4 | Scoped to admin-configured API integrations and CRM lookups with no shell, file write, or arbitrary code execution capability [10]. |
| Orchestration | 1 / 4 | Multi-turn conversations within a single session lifecycle with no background execution, scheduling, or daemon operation [9]. |
| Inter-Agent | 0 / 4 | No inter-agent communication exists; each conversation is handled by a single AI agent instance with escalation going to human agents only [14]. |
| Output Processing | 1 / 4 | Text-based responses with PII sanitization on output but no documented exfiltration channel blocking or URL sanitization specific to AI output [8]. |
| Configuration | 1 / 4 | Admin-controlled configuration through Zendesk Admin Center with no auto-loaded project files or community plugin marketplace [10]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Zendesk AI accepts untrusted customer messages across multiple channels, operates over CRM records and ticket data, and sends responses to end users and outbound API calls to third-party systems.
Zendesk AI exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Customer messages via messaging, email, and voice channels feed untrusted natural-language content directly into the reasoning loop [6][9].
- Sensitive data — The agent accesses CRM records, ticket history, and session parameters containing customer names, emails, and order data [1][2][3].
- External egress — Responses flow to end customers and custom actions make outbound HTTP calls to configured external systems [10][15].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised Zendesk AI session reaches outbound API endpoints and stored CRM credentials but not code execution, file systems, or deployment infrastructure.
Higher blast scores indicate factors where a compromised session can reach sensitive resources beyond the immediate conversation interaction.
Each row maps a blast-radius factor to its score and identifies the specific workflow boundary or credential scope that defines the exposure.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 0 / 4 | No shell, sandbox, or arbitrary code execution is exposed; all operations are API-call-based within the vendor's managed cloud runtime [9]. |
| File system access | 0 / 4 | No file system access is available; the agent is a cloud SaaS product without direct filesystem interaction [7]. |
| Network access | 2 / 4 | Domain-restricted outbound via admin-configured API integrations only with no arbitrary URL fetching from the agent [10]. |
| Credential access | 2 / 4 | API keys stored in the integration builder and CRM credentials passed through for configured external system calls [10]. |
| Autonomous action | 2 / 4 | Configured actions execute autonomously within conversation flows with escalation thresholds but no per-invocation approval gate [14]. |
| Deployment access | 0 / 4 | No deployment, infrastructure modification, or package publishing capability exists within the agent's documented feature set [9]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Zendesk publishes cloud isolation, admin action governance, and SOC 2 certified conversation logging while leaving input-filter verification and output DLP to the operator.
Higher defense scores indicate stronger vendor-implemented safeguards that reduce the operator's residual hardening burden on the default configuration.
Each component is scored on what the vendor implements and documents versus what falls to the operator to configure or build externally.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | Vendor documents guardrails combining prompt engineering and code architecture with continuous adversarial evaluation but no published injection detection benchmark [5][6][11]. |
| Execution Isolation | 2 / 3 | Cloud-hosted multi-tenant SaaS on AWS with SOC 2 and ISO 27001 certified infrastructure providing tenant isolation without published AI-layer pentest results [15][12]. |
| Action Controls | 2 / 3 | Admin-configured actions with escalation strategies and availability checks but configured actions execute autonomously without per-invocation approval gates [14][10]. |
| Output Guardrails | 1 / 3 | PII sanitization and entity anonymization documented for data processing but no independently verified DLP or exfiltration blocking for AI output [8]. |
| Monitoring | 2 / 3 | Full conversation audit trail capturing reasoning decisions and resolution outcomes under SOC 2 compliance but no documented SIEM forwarding [13][15]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize independent input-filter verification and egress-layer DLP to break the trifecta on the default configuration.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require security review of all external knowledge sources before connecting them to the AI agent's generative reply pipeline.
- Configuration Restrict knowledge source connectivity to first-party help center content only, removing web-crawled external sources from the agent configuration.
- Engineering Deploy a third-party prompt-injection detection classifier upstream of the AI agent via the custom API integration path.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Require separate Zendesk instances for production and development AI agent configurations to prevent test-mode permissiveness.
- Configuration Enable Advanced Data Privacy and Protection add-on to enforce additional tenant isolation and data locality constraints.
- Engineering Implement network-level controls on integration builder endpoints to restrict which external APIs the agent can reach.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Establish a formal review gate requiring security sign-off before activating any new custom action or API integration.
- Configuration Configure email automation thresholds to minimize use cases handled autonomously before human escalation is required.
- Engineering Build action flow validation logic that cross-checks CRM write operations against a known-safe parameter allowlist.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Require all AI-generated responses to pass through a DLP scanning layer before delivery to end customers.
- Configuration Configure entity recognition rules to cover organization-specific sensitive patterns beyond the default PII categories.
- Engineering Implement response content policies blocking AI-generated messages containing URLs or formatted links to prevent link-injection.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Define a retention and review cadence for conversation logs including weekly automated anomaly scans for unusual patterns.
- Configuration Forward conversation logs to a centralized SIEM with alerting rules for anomalous conversation patterns and API call volumes.
- Engineering Implement resolution state webhooks triggering automated alerts when conversations reach unexpected states or high unresolved rates.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2024-49193 Zendesk Email Spoofing CVSS 7.5 email spoofing grants unauthorized ticket history access patched 2024-07-02
- Zendesk Email Spoofing Full Disclosure Independent disclosure demonstrating Fortune 500 impact via predictable ticket emails and spoofed Cc fields
- Zendesk Email Spoofing News Coverage CyberSecurity News coverage of CVE-2024-49193 detailing attack chain including Apple SSO and Slack access
Selected Research
- InjecAgent Indirect Prompt Injection Benchmark 2024 benchmark of indirect prompt injections across 17 tools and GPT-4 ReAct agents vulnerable 24% of time
- Prompt Injection in AI Chatbot Plugins IEEE S&P 2026 studies third-party chatbot plugin injection risks and excludes enterprise solutions like Zendesk from scope
Vendor Documentation
- AI Trust at Zendesk Vendor trust page describing privacy and security guardrails and AI governance program modeled on NIST AI RMF
- Generative AI Data Protection Documents zero data retention with LLM providers and multi-provider architecture and sub-processor terms
- AI Agent Data Processing PII sanitization and anonymization methods for AI agent input processing
- About AI Agents Official agent capabilities including messaging email voice channels and agentic AI actions and integrations
- AI Agent Actions Four action types configured actions and API integrations and action flows and custom actions
- Building Defensible AI Continuous adversarial security evaluation program and resolution learning loop for guardrail improvement
- Zendesk ISO 42001 Certification AI governance certification covering all core AI features and lifecycle governance and risk assessment
- Conversation Logs and Monitoring Full conversation audit trail with reasoning controls and resolution state tracking
- Escalation Strategies Human handoff controls and availability checks and escalation blocks in dialogue builder
Other Sources
- Zendesk Trust Center SOC 2 and ISO 27001 and FedRAMP and ISO 42001 certifications and enterprise security overview
- Agentic AI Capabilities Autonomous decision-making and adaptive reasoning and reasoning controls visibility