    Critical Vulnerabilities in ChatGPT Workspace Agents AgentForger Research Analysis 0 views Eyal Estrin unread, 12:24 AM (20 minutes ago)    to Part 1: ChatGPT Cross-Site Agent Forgery https://labs.zenity.io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery Part 2: The Autonomous Insider https://labs.zenity.io/p/agentforger-part-2-the-autonomous-insider Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

A critical vulnerability in OpenAI's ChatGPT Workspace Agents, dubbed AgentForger, that allowed a single phishing link to silently build, configure, and publish an attacker-controlled autonomous agent...

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since been addressed by OpenAI as of June 8,

A patched OpenAI flaw let attackers create autonomous agents that live inside enterprise environments, highlighting how AI agents are reshaping enterprise security.

Discover how the ChatGPT AgentForger vulnerability lets attackers plant rogue AI insiders with a single link, and learn how to protect your company.

AI agents are evolving from assistants to autonomous threats. On one hand, the #AgentForger vulnerability allows attackers to plant rogue AI agents in corporate workspaces via a simple link. On the o

A critical vulnerability in OpenAI’s ChatGPT Workspace Agents, dubbed AgentForger, that allowed a single phishing link to silently build, configure, and publish an attacker-controlled autonomous agent inside a victim’s organization. Unlike traditional Cross-Site Request Forgery (CSRF), which forges a single unauthorized request, AgentForger forges the creation of an entire autonomous AI agent operating inside the victim’s trust boundary. ChatGPT Agent Builder prompt interface (Image source: labs.zenity.io) ChatGPT AgentForger Vulnerability Workspace Agents connect to core enterprise services like Outlook, Gmail, Slack, Google Drive, SharePoint, and Microsoft Teams. Under normal operating conditions, users create these agents through an interactive conversational builder canvas. Intended 7-step agent creation workflow (Image source: labs.zenity.io) As detailed in the technical analysis by Security researchers at Zenity Labs on AgentForger: ChatGPT Cross-Site Agent Forgery, Zenity found that this builder accepts initialization state directly through URL parameters, specifically template_name and initial_assistant_prompt . Rather than simply populating an input box, the initial_assistant_prompt parameter is automatically submitted and executed the moment the page loads. This design flaw allowed an attacker to embed a full set of malicious instructions inside an ordinary-looking ChatGPT link and send it as a targeted phishing email. These vectors build upon emerging device code phishing tactics that exploit trusted application flows. When a logged-in victim with at least one pre-authorized connector clicked the link, the Builder autonomously created an agent, attached all previously connected integrations, and switched write-action approvals from “Always ask” to “Never ask,” disabling the primary safeguard meant to block silent, sensitive actions. Chief of Staff agent template and connected workspace tools (Image source: labs.zenity.io) The forged agent was then published live and scheduled to run every five minutes, polling the attacker’s inbox for commands prefixed with "TASK" and emailing results back out, effectively turning ChatGPT into a covert command-and-control (C2) channel. Because the connectors were already authorized from prior legitimate usage, no new OAuth consent screen appeared to alert the victim. Researcher Mike Takahashi demonstrated that the resulting “agentic insider” could map organizational structures, exfiltrate sensitive documents, harvest credentials, and impersonate the victim across Slack, Teams, and email, mirroring tactics seen in AI-assisted phishing operations. Architecture comparison between traditional CSRF and AgentForger (Image source: labs.zenity.io) Zenity attributes the flaw to two combined architectural weaknesses: Cross-Site Auto-Execution: The Builder’s willingness to execute unvalidated URL parameters upon page load. Overpermissive Natural-Language Control: Allowing natural-language prompts to modify security-sensitive settings like approval policies and execution schedules. Together, these factors satisfied what researchers call the “lethal trifecta” untrusted input, access to private data, and an unmonitored path to exfiltrate it. Attack Stage Mechanism Impact Delivery Phishing link containing crafted initial_assistant_prompt Initial execution trigger Execution Auto-submitted prompt builds agent & attaches connectors Unauthorized workspace access Privilege Bypass Approval setting flipped to “Never ask” Silent action execution Persistence Recurring 5-minute schedules polling attacker inbox Continuous C2 communication Impact Data exfiltration, credential harvesting, BEC staging Full workspace takeover Zenity reported the vulnerability to OpenAI via Bugcrowd on June 4, 2026. The report was triaged and accepted within 24 hours and fully patched on June 8, 2026, by removing the vulnerable URL parameter handler. OpenAI’s fix mitigated newly initiated attacks, and Zenity confirmed no evidence of active exploitation in the wild prior to the patch. Zenity’s follow-up analysis highlights how a forged agent, once operational, can be tasked like a genuine attacker-controlled insider to conduct internal reconnaissance and stage business email compromise (BEC) across an enterprise.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link appeared first on Cyber Security News .

A patched OpenAI flaw let attackers create autonomous agents that live inside enterprise environments, highlighting how AI agents are reshaping enterprise security.

Secure your AI agents against prompt injection. Use Prompt Injection Shield Prover for OWASP-compliant LLM security audits in Claude or Cursor.

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since been addressed by OpenAI as of June 8,

Design and implement governance policies, identify security risks, detect emerging threats and drive automatic mitigation and response.

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since been addressed by OpenAI as of June 8,

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has bee

A new attack method found by Zenity Labs reveals that AI agents are becoming persistent insiders that attackers can recruit, rather than malware they have to install. Its researchers have discovered AgentForger, a phishing-based attack that silently creates and launches a fully autonomous AI agent within OpenAI workspaces. Once running, the agent has full access to apps like Outlook, Slack, SharePoint, and Google Drive. It is configured to operate indefinitely without further user interaction, can approve its own access by toggling “never ask” settings, and can continue to act on new assignments sent via email by the attackers that control it. Broad, unfettered access to systems allows it to perform reconnaissance, harvest sensitive data and credentials, impersonate victims, and launch phishing campaigns. While OpenAI resolved the vulnerability four days after disclosure, on a larger scale, AgentForger sheds light on what can happen when AI agents go rogue. “We’re moving into a world where software doesn’t just help people work. It works alongside them,” said Michael Bargury, co-founder and CTO of agentic AI security platform Zenity. “As AI agents become more capable, attackers will naturally look for ways to influence them, just as they’ve always looked for ways to influence people.” ## A ‘persistent operator’ that acts without approval OpenAI’s Workspace Agents can connect and work autonomously across Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams. Users open the agent builder, describe what the agent can do in natural language, connect to tools, set approvals, review and test, schedule actions, then publish. For instance, an agent can autonomously handle incoming emails, review and take actions with approval, gather information from various sources to send out daily briefings, or automatically respond to questions in ChatGPT or Slack channels. Normally, this is “useful automation,” Zenity AI red team researcher Mike Takahashi wrote in a blog post. But in this attack, “the same scheduler becomes the persistence mechanism.” The creation workflow kicks off the moment a user clicks on a phishing link containing instructions from the threat actor. For the attack to work, a victim must be logged into ChatGPT and Workspace Agents, and have at least one integration with another app, such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Teams. Because those connections already exist, OAuth consent screens are not triggered. Furthermore, the victim does not need to click on another link, keep a Builder tab open, or even visit ChatGPT again. The forged agent is a “persistent operator;” it is installed on the original click and given a schedule, and at those predetermined times, the agent invokes itself, scans for emails from attacker addresses with the subject line “task”, carries those orders out, then returns results to the same attacker-controlled email address. It goes undetected because the attacker prompt instructs the Builder to toggle Outlook to never ask for approval of its actions. Typically, the default is “always ask,” to keep agents from taking unauthorized action; that switch gives agents the ability to act without asking for human approval. “AgentForger showed that an attacker could deploy an autonomous insider agent inside your ChatGPT workspace with a single click,” said Bargury. From there, it can continue to access information, harvest credentials from various sources, impersonate employees, and carry out phishing attacks and fraud while “leveraging the trusted victim’s identity.” ## A ‘planted accomplice’ that does all the work Once activated, AgentForger can perform reconnaissance to create an internal map of a company. For instance, agents can scan Outlook, Slack, Teams, Google Drive, SharePoint, or calendar data to identify people, roles, active projects, internal discussions, or all-hands recurring meetings. This can help attackers identify where in the enterprise to target next, based on active teams and channels, projects in the works, or prominent users. “This is the kind of internal context an attacker normally has to build slowly,” Takahashi noted. But in this scenario, action is based on a single emailed assignment. The attacker’s “planted accomplice” does all the work. In another scenario, the agent can steal data by searching for and identifying financial documents, business agreements, or invoices. Or, it can steal credentials by scanning for messages containing passwords, one-time codes, access tokens, password recovery links, or API keys. Further, it can impersonate victims to carry out phishing scams, for instance, by sending legitimate-looking Teams messages instructing users to confirm their credentials on a fake Microsoft login page. In all cases, collected information is organized, analyzed, and sent back to the attacker. “AgentForger points to something much bigger than a single vulnerability,” said Bargury. “It’s less about one bug and more about understanding how the security model changes as AI becomes part of everyday business operations.” ## FOMO exposing security gaps This isn’t necessarily about trust, but more about the need to move fast and adapt, Bargury emphasized. AI agents are helping employees automate work, make decisions faster, and get more done. But enterprises fear they’ll fall behind if they don’t move quickly enough. “The challenge is that we’re introducing a fundamentally new kind of technology into the enterprise,” said Bargury. “The pressure to integrate the next AI feature is outpacing the security controls needed to safely deploy it.” However, the answer isn’t to slow down adoption, he emphasized; the business value is too significant. Rather, the first step is understanding where AI agents exist, who created them, what they’re connected to, and what they’re allowed to do. And when it comes to autonomous agents, enterprises need to pay attention to the processes that trigger them: A schedule, an incoming email, or another automated event. “Those triggers should be governed just as carefully as the agent itself,” said Bargury. High-impact actions should require approval where appropriate, and security teams should be able to quickly disable an agent or its triggers if something doesn’t look right, he said. More broadly, AI agents are introducing the need for a new security model, he pointed out. The question is no longer just “Does this agent have permission?” It’s also, “Is this the behavior we intended?” “The organizations that answer both questions will be in the strongest position to adopt AI safely,” Bargury said.

Zenity Labs disclosed AgentForger, a critical CSRF flaw in OpenAI’s ChatGPT Workspace Agents that could let a phished employee unknowingly create an invisible autonomous agent controlled by an attacker. The attack could abuse ChatGPT Agent Builder parameters to hide the agent, accept attacker emails as commands, and enable covert access to...

Zenity Labs uncovered "AgentForger," a vulnerability in OpenAI's Agent Builder that let a single manipulated ChatGPT link create an autonomous agent on an employee's behalf. The agent inherited the victim's identity and access rights, bypassed approval requirements through the malicious prompt, and pulled new instructions from the attacker's inbox every five minutes.

AgentForger allows an attacker to create, insert and remotely control an invisible autonomous AI agent inside a victim organization.