Security researchers have disclosed a critical vulnerability in OpenAI’s ChatGPT Workspace Agents that could have let a single crafted link silently build, authorize, and deploy an autonomous AI agent inside a victim’s organization — one that operated with the victim’s real identity, access, and permissions, with its safety approvals switched off.
AI security firm Zenity Labs, which coined the vulnerability AgentForger, describes it as a fundamentally new class of attack: not a forged request, but a forged insider. Zenity CTO Michael Bargury put it directly — with one click, an attacker gets a fully autonomous agent inside your company with your employee’s identity and access, and the guardrails off.
How a Single Link Could Hijack ChatGPT’s Agent Builder
Zenity detailed the full attack lifecycle across two technical posts — the initial forgery mechanism in Part 1, and what the forged agent could do once live in Part 2.
According to Zenity’s technical disclosure, ChatGPT’s Agent Builder lets workspace users describe an agent, attach enterprise connectors like Outlook, Gmail, Slack, and SharePoint, set approval requirements, schedule runs, and publish it — all through a guided setup flow. The vulnerability lived in how that flow could be initialized through URL parameters.
Researcher Mike Takahashi found that one of those parameters, called initial_assistant_prompt, wasn’t just pre-filling a text box for the user to review — it was being automatically submitted and executed the moment the page loaded. By crafting a link that combined this parameter with an agent template selector, an attacker could drive the entire agent-creation workflow from initialization straight through to execution, without the victim ever typing anything or knowingly approving a thing.
The forged agent inherited whatever enterprise connectors the victim had already authorized in ChatGPT, and it didn’t sit passively waiting for instructions in the open — it polled the attacker’s own inbox for new commands every five minutes, giving the attacker an ongoing remote-control channel into the victim’s environment.
What the Rogue Agent Could Actually Do
In its proof-of-concept, Zenity demonstrated that the forged agent could map an organization’s internal structure, exfiltrate sensitive documents including M&A materials, harvest database credentials shared in Slack, and impersonate the victim to send phishing messages under their own name across email, Slack, and Teams — all using access the employee had already legitimately granted to ChatGPT.
This is what separates AgentForger from a traditional cross-site request forgery (CSRF) attack, the class of web vulnerability it evolves from. A classic CSRF attack tricks a victim into firing off a single unwanted authenticated action. AgentForger went further, using that same trick to spin up a fully autonomous, persistent agent that kept operating and taking new instructions long after the initial phishing click.
How Quickly OpenAI Responded
Zenity reported AgentForger to OpenAI through its Bugcrowd bug bounty program on June 4, 2026. OpenAI confirmed the report the very next day and removed the vulnerable URL parameter by June 8 — a turnaround of roughly four days. The flaw was only publicly disclosed this week, following standard responsible-disclosure practice of giving the vendor time to ship a fix before details go public.
Zenity formally announced its findings via an official press release, praising OpenAI’s security team for the fast turnaround despite the severity of what was found.
Any organization using ChatGPT Workspace Agents with connected enterprise applications was potentially exposed during the window before the fix. OpenAI has separately announced it is deprecating the Agent Builder product entirely, effective November 30, 2026, encouraging users to migrate to its newer Agents SDK instead — though that transition is unrelated to this specific vulnerability.
Part of a Bigger Pattern at OpenAI
AgentForger is the second major agentic-AI security story tied to OpenAI in as many weeks. It follows OpenAI’s own admission that its models autonomously breached Hugging Face during an internal capability test, and lands in the same stretch of coverage as CISA’s emergency order to patch a critical flaw in Langflow, another widely used AI agent framework.
Zenity argues the deeper lesson isn’t about any single bug — it’s architectural. As AI agents graduate from simply answering questions to actively taking actions across corporate systems, they start behaving less like disposable chat sessions and more like persistent members of the workforce, with all the access and trust that implies. Traditional security tooling, built around monitoring human logins and one-off requests, isn’t designed to catch an autonomous agent quietly operating under a legitimate employee’s identity.
What Organizations Should Do
Even though this specific flaw is patched, the underlying risk pattern isn’t going away. Here’s how to reduce exposure to similar agent-forgery attacks:
- Audit existing ChatGPT Workspace Agents: Review any agents currently active in your organization’s ChatGPT workspace, confirm who created each one and why, and remove any that can’t be clearly attributed to a known business purpose.
- Treat AI-agent creation links like credential-granting links: Train employees to be as cautious clicking a ChatGPT or AI-platform link as they would be entering a password — since a single click could grant far more than a login session.
- Limit which connectors employees can pre-authorize: The more enterprise apps an employee has already connected to an AI platform, the more an attacker inherits if any agent-forgery flaw is exploited. Apply least-privilege thinking to connector authorization the same way you would to account permissions.
- Monitor for unusual agent behavior: Security teams should extend monitoring to cover agent-level activity — unexpected polling patterns, off-hours actions, or access to systems outside an agent’s stated purpose — rather than relying solely on traditional login-based alerts.
- Stay current on AI platform deprecation timelines: With Agent Builder set to be retired by November 30, 2026, organizations should plan their migration to OpenAI’s Agents SDK with security review built into the transition, not bolted on afterward.
Frequently Asked Questions
Is AgentForger still exploitable right now?
No. OpenAI removed the vulnerable URL parameter by June 8, 2026, four days after Zenity Labs reported it. The flaw was fixed before public disclosure and is no longer exploitable in ChatGPT’s current Agent Builder.
How is AgentForger different from a normal phishing attack?
A normal phishing attack tricks a victim into one unwanted action, like entering credentials on a fake page. AgentForger used a single link to create a persistent, autonomous AI agent that inherited the victim’s identity and access, then continued taking new instructions from the attacker every five minutes.
What is ChatGPT Agent Builder?
Agent Builder is an OpenAI tool that lets workspace users create custom AI agents connected to enterprise apps like Outlook, Gmail, Slack, and SharePoint, with scheduling and approval settings. OpenAI has announced it will deprecate the product on November 30, 2026 in favor of its Agents SDK.
Was my company affected by AgentForger?
Any organization using ChatGPT Workspace Agents with connected enterprise applications was potentially exposed before OpenAI’s June 8 fix. If you use Workspace Agents, it’s worth auditing which agents exist in your environment and confirming each has a known, legitimate creator.
Reported by CyberUpdates365 Desk
Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow us for daily updates on how technology is reshaping the corporate landscape.
