Zero-click execution is code execution that happens without a separate user approval step after a malicious payload has already been installed or delivered. The user does not need to open a file, tap a link, or confirm a prompt for the payload to run; the trigger is built into the target application, service, or agent workflow.
This matters because it removes the visible warning signs defenders often rely on. Attackers look for software that automatically parses content, loads plugins, processes messages, or runs helper code with broad privileges. In those cases, a successful compromise can turn into immediate execution on the victim system or inside an AI agent environment. Defenses focus on reducing implicit execution: verify installed code, sandbox risky components, disable unnecessary auto-loading, limit privileges, and monitor for unexpected process starts or plugin changes. In practice, zero-click execution is especially dangerous when the trusted component can update or load code on its own.