A single, seemingly benign phishing link is all it takes to silently forge an autonomous, rogue ChatGPT agent inside an organization, weaponizing OpenAI’s own tools against its users. This critical vulnerability, tracked as AgentForger and disclosed by AI security firm Zenity Labs, exploits a now-patched flaw in OpenAI’s ChatGPT Workspace Agent Builder to grant an attacker persistent, authenticated access to a victim’s connected enterprise applications. The attack does not require the target to click a second time, approve a pop-up, or even keep their browser tab open. It transforms a single moment of inattention into a long-term, automated compromise.
What is the AgentForger Vulnerability?
AgentForger is a cross-site request forgery (CSRF) vulnerability that existed within OpenAI’s ChatGPT Agent Builder, a visual, drag-and-drop interface that allowed users to construct multi-step AI agent workflows. Zenity Labs discovered that the Builder tool accepted an initialization state directly through URL parameters. Specifically, two parameters—the agent template and the prompt to the builder—could be passed in the link itself. Critically, when the page loaded, the value of the embedded prompt was not merely placed into the prompt box for review; it was automatically submitted and executed. This meant that a carefully crafted instruction embedded inside a URL could become the first command the Builder acted on, all without the user’s knowledge or consent.
How Does the AgentForger Attack Chain Work?
The attack unfolds in a sequence of automated steps, triggered by a single click from an unsuspecting employee. The attacker crafts a phishing link that adheres to a specific pattern: chatgpt[.]com/agents/studio/new?template_name=[template name]&initial_assistant_prompt=[malicious prompt]. When a logged-in user clicks this link, the ChatGPT Builder opens within their authenticated session and immediately executes the malicious prompt. The attack requires three specific conditions to be met: the victim must be logged into ChatGPT, they must have access to Workspace Agents, and they must have at least one authorized connector to an enterprise application such as Outlook, Gmail, Google Calendar, Google Drive, Slack, or Teams.
The Forging Process: From Link to Persistent Agent
The malicious prompt embedded in the URL instructs the Builder to perform a specific sequence of actions. First, it creates a new agent based on the chief-of-staff template, which is designed to pull data from workspace applications to prepare an operating brief. The prompt then attaches all previously authorized connectors and critically sets each one to a “Never ask” permission mode, thereby disabling any future user approval requirements. The agent is then made live and scheduled to run every hour, establishing a persistence mechanism. During each scheduled run, the agent checks the victim’s email for messages from a specific attacker-controlled address with a subject line beginning with “TASK.” It executes those tasks and sends the results back to the attacker via email. Finally, the prompt invokes Preview Mode, which is intended for testing but in this context runs the newly forged agent immediately against the victim’s connected accounts using the attacker-defined approval settings.
Why This Vulnerability Represents an Agent Trust Failure
Zenity Labs characterized AgentForger as a fundamental agent trust failure. The platform inherently trusted that the user intentionally created, approved, scheduled, and operated the agent. The vulnerability revealed that this trust was misplaced. The forged agent becomes a persistent operator: the initial click installs it, the schedule keeps it alive, and the connected apps provide a source of commands, access to sensitive data and actions, and a path to return results. Once deployed, the rogue agent can conduct reconnaissance, harvest sensitive documents from cloud storage, steal passwords mentioned in Slack messages, and even impersonate the victim to send phishing links on Microsoft Teams to other employees. These phishing links can direct recipients to a fake Microsoft login page designed to capture their credentials, opening the door to broader organizational compromise and business email compromise (BEC) scenarios.
When Was the AgentForger Vulnerability Patched?
Zenity Labs responsibly disclosed the AgentForger vulnerability to OpenAI, and the company addressed the flaw as of June 8, 2026. OpenAI subsequently announced that it would be deprecating the Agent Builder product effective November 30, 2026, urging users to migrate to the Agents SDK. The timeline underscores the critical nature of the flaw, as it required a full patch and subsequent product retirement to fully mitigate the risk.
What Are the Broader Implications for AI Security?
The AgentForger vulnerability is not an isolated incident. It emerges from a broader pattern of security risks in the rapidly expanding AI infrastructure landscape. Zenity Labs has previously highlighted how threat actors are exploiting critical vulnerabilities in LiteLLM and exposed Ollama endpoints to hijack AI infrastructure. These efforts involve the abuse of vulnerabilities including CVE-2024-6587, CVE-2026-40217, and CVE-2026-35029. Self-hosted model servers and agent frameworks continue to be deployed while misconfigured and unauthenticated, often on predictable ports and willing to serve any client. This turns exposed AI infrastructure into convenient, deniable backend compute for offensive AI agents. The AgentForger flaw demonstrates that the threat is not limited to poorly configured self-hosted systems but can also manifest within the carefully managed cloud services of major AI providers.
What Is the Strategic Significance of This Attack?
The strategic significance of AgentForger lies in its ability to convert a traditional phishing vector into a persistent, autonomous insider threat. Traditional phishing attacks often require multiple interactions, credential harvesting, or lateral movement. AgentForger collapses this complexity into a single, automated process. The attacker does not need the victim to click another link, keep the Builder tab open, or approve subsequent actions. Once the agent is published and scheduled, the attacker can continuously send assignments through the victim’s mailbox. Each TASK email becomes a new assignment for the agent. The agent is not waiting for another click—it is waiting for instructions. This transforms a moment of user error into a long-term, self-sustaining compromise that operates within the trust boundary of the organization.
Practical Consequences for Enterprise Security Teams
For enterprise security teams, the AgentForger vulnerability highlights several critical areas requiring immediate attention. Organizations using ChatGPT Workspace Agents must verify that all instances of the Agent Builder have been fully patched or migrated to the Agents SDK. The discovery also underscores the importance of reviewing all authorized connectors and ensuring that approval requirements are not easily bypassed by automated processes. Security awareness training must now include specific scenarios involving AI-powered phishing links that appear to originate from trusted enterprise tools. The attack demonstrates that the traditional distinction between internal and external threats is becoming increasingly blurred, as a rogue AI agent operating within the corporate network can be as dangerous as an external attacker.
How Can Organizations Defend Against AgentForger-Style Attacks?
Defense against AgentForger and similar attacks requires a multi-layered approach. First, organizations should strictly limit the number of users with access to AI agent building tools and enforce robust approval workflows for any new agent creation. Second, all connector integrations should be configured with the principle of least privilege, requiring explicit user consent for each action rather than blanket approvals. Third, email and messaging systems should be monitored for unusual patterns of agent-created messages, particularly those containing “TASK” subject lines or commands from external addresses. Fourth, browser security policies should restrict the ability of pages to automatically execute embedded prompts without user interaction. Finally, security teams should conduct regular audits of all active AI agents within the organization to detect any unauthorized or suspicious instances.
The Future of AI Agent Security
The AgentForger vulnerability serves as an early warning for the broader AI industry as it moves toward agentic systems that can act autonomously on behalf of users. The fundamental challenge is that agents, by design, require a degree of trust and autonomy to be useful, but this trust creates exploitable surfaces. As AI agents become more sophisticated and integrated into enterprise workflows, the potential for similar attacks will grow. The security community must develop new paradigms for agent authentication, authorization, and behavioral monitoring that go beyond traditional web security models. The response to AgentForger—responsible disclosure, prompt patching, and product deprecation—represents the current best practice, but the industry will need to evolve more proactive and resilient security architectures to keep pace with the capabilities of autonomous AI systems.
