Cybersecurity researchers at Zenity Labs have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents — dubbed AgentForger — that could have allowed a single phishing link to silently build, authorize, and deploy an autonomous AI agent inside a victim's organization. The flaw was patched in just four days after disclosure, but the attack surface it revealed has significant implications for enterprise AI security.
What Is AgentForger?
AgentForger is a Cross-Site Agent Forgery (CSAF) vulnerability — an evolution of classic CSRF that doesn't just forge a single unwanted action, but forges an entire autonomous AI agent deployed silently inside a target organization. The flaw resided in ChatGPT's Agent Builder (part of Workspace Agents, an enterprise feature).
Lead researcher Mike Takahashi of Zenity's AI Red Team described the root cause plainly: "We found that when the page loads, the value of initial_assistant_prompt is not merely placed into the prompt box. It is automatically submitted and executed."
Michael Bargury of Zenity put the impact in starker terms: "With one click, an attacker gets a fully autonomous agent inside your company that has your people's identity and access, with the guardrails off."
The Technical Mechanism
The Agent Builder initialization URL accepts two parameters that became the attack vector:
chatgpt.com/agents/studio/new?template_name=[template]&initial_assistant_prompt=[payload]
Attackers defaulted to the "Chief of Staff" template — the most powerful available, granting the widest set of tool and connector permissions.
The critical flaw was in initial_assistant_prompt: rather than pre-filling a text box for the user to review and manually submit, the Agent Builder automatically executed the embedded payload on page load with no additional confirmation required.
A crafted payload would instruct the Builder to:
- Create an agent from the Chief of Staff template
- Attach all available enterprise connectors with approval settings set to "Never ask" (bypassing all per-action confirmation guards)
- Schedule hourly or every-5-minute execution for persistence
- Monitor the victim's email inbox for attacker messages with a "TASK" subject prefix
- Execute those instructions autonomously using the victim's identity
- Email results back to the attacker
The Attack Chain
The complete attack required only one victim action — clicking a link:
- Attacker crafts a malicious
chatgpt.comURL with the embedded payload - Victim receives the link via phishing (disguised as a legitimate ChatGPT invite, shared document, etc.)
- Victim — authenticated to ChatGPT with Workspace Agents access — clicks the link
- Agent Builder auto-executes the embedded prompt on page load
- A rogue agent is silently created, connectors attached, approvals disabled
- Agent begins polling victim's email for
TASK-prefixed messages - Attacker sends task commands; agent executes them and reports back
- The agent persists on a schedule indefinitely
Prerequisites: The victim must be logged into ChatGPT, have Workspace Agents access, and have at least one authorized connector already configured (Gmail, Outlook, Slack, Teams, Google Drive, SharePoint, etc.).
What the Rogue Agent Could Do
Zenity demonstrated more than 12 proof-of-concept scenarios. Once deployed, the forged agent could:
- Reconnaissance — map the organization's internal environment and connected systems
- Data exfiltration — harvest sensitive documents from Google Drive or SharePoint
- Credential harvesting — extract credentials embedded in Slack messages
- Identity impersonation — send emails, Teams messages, and Slack posts as the victim
- Internal phishing — propagate additional malicious ChatGPT links to colleagues, creating a self-replicating insider attack chain
- Business Email Compromise staging — position for downstream financial fraud
The agent operated with the full identity and permissions of the victim user — indistinguishable from legitimate activity by the real employee.
Patch and OpenAI's Response
Zenity reported the vulnerability to OpenAI via Bugcrowd on June 4, 2026. OpenAI accepted the report the following day and deployed a fix by June 8 — a four-day resolution window. Public disclosure followed on July 23.
No evidence of in-the-wild exploitation was found prior to the patch being applied.
The fix removed the vulnerable initial_assistant_prompt URL parameter from the Agent Builder, eliminating the auto-execution vector. OpenAI has also announced the deprecation of Agent Builder effective November 30, 2026, directing enterprise users to migrate to the Agents SDK.
No CVE was assigned for this vulnerability.
The Broader Lesson: Agent Trust Failures
Zenity frames AgentForger as an "agent trust failure" — the ChatGPT platform implicitly trusted that any agent created through the Builder was intentionally created by the legitimate account holder, with no mechanism to verify whether the session was initiated voluntarily.
This is a category of vulnerability the industry is only beginning to fully understand. As AI agents proliferate across enterprise environments — connecting to email, file storage, communication platforms, and cloud infrastructure — the attack surface for identity abuse and unauthorized automation grows in parallel.
For enterprise security teams, the AgentForger case points to several urgent controls:
- Treat Workspace Agents like privileged service accounts — they need the same inventory tracking, creation approvals, and quarterly access reviews as admin roles and OAuth apps
- Audit existing agents for suspicious connectors, "never ask" approval settings, or scheduled execution patterns
- Apply CSRF-resistant controls to agent creation flows — no agent should be creatable without an explicit user-initiated action
- Monitor for unusual agent-to-email or agent-to-Slack activity as indicators of compromise
The convergence of phishing and agentic AI creates an attack primitive that's materially more dangerous than either in isolation. AgentForger won't be the last vulnerability of this type.
Sources: The Hacker News, Zenity Labs, SecurityWeek