A critical security vulnerability was recently discovered in OpenAI’s ChatGPT Workspace Agents, identified as AgentForger by Zenity Labs. This flaw, a specific form of cross-site request forgery (CSRF), allowed attackers to potentially control an autonomous agent within a targeted organization through a phishing attack.
Discovery of the Vulnerability
Zenity Labs published detailed insights into the vulnerability, revealing that it stemmed from an over-permissive parameter within ChatGPT’s Agent Builder. The researchers found that by manipulating the initialization URL with specific parameters, attackers could create a powerful agent. One parameter determined the agent template, while the other, ‘initial_assistant_prompt’, provided execution instructions. The use of the ‘Chief of Staff’ template facilitated the creation of a more sophisticated agent.
This manipulation enabled the attacker to embed prespecified instructions into the agent, including accepting new instructions via emails, effectively allowing remote control over the agent’s actions.
How the Exploit Worked
For the attack to be successful, several conditions needed to be met. The targeted employee had to be using ChatGPT, have access to Workspace Agents, and possess at least one authorized connector, such as Gmail or Outlook, to avoid triggering a new OAuth consent screen. The victim would then need to be tricked into clicking a malicious URL, which guided the agent’s initial actions.
These actions included checking emails from a specified address, executing tasks detailed in those emails, and sending results back to the attacker without any redaction. The attacker’s instructions also ensured that the agent remained hidden and operational without requiring user approval during its setup.
Response and Resolution
Zenity’s co-founder, Michael Bargury, stressed the severity of the issue, noting that the attack effectively created a forged insider with the victim’s identity and access. This allowed the attacker to operate within the organization’s trust boundary, performing tasks like reconnaissance, data theft, and internal phishing.
Once Zenity reported the issue to OpenAI, the company acted swiftly to rectify the flaw. OpenAI acknowledged the problem the day it was reported and implemented a fix within three days. The vulnerability, disclosed publicly on June 4, was resolved by June 8.
Implications and Future Considerations
This incident highlights the potential risks associated with autonomous agents and the importance of robust security measures. As technology evolves, security protocols must adapt to address new threats. OpenAI’s prompt response is a positive step, but ongoing vigilance and enhancement of cybersecurity measures remain crucial to safeguarding digital environments.
