Cybersecurity experts have revealed a serious security gap in OpenAI’s ChatGPT Workspace Agents, termed as AgentForger, which could have been exploited through a single phishing link to create unauthorized AI agents within a company. Zenity Labs uncovered this flaw, leading to OpenAI addressing the issue by June 8, 2026, following a responsible disclosure.
Understanding the AgentForger Vulnerability
This vulnerability allowed attackers to misuse OpenAI’s ChatGPT Agent Builder, a tool for creating AI workflows, to set up AI agents with unauthorized access. The attack is initiated when an employee clicks on a seemingly harmless ChatGPT link, enabling the creation of an attacker-controlled AI agent within the organization. This is a cross-site request forgery (CSRF) issue where the AI agent is controlled by a malicious actor.
The Builder tool accepts initialization data through URL parameters, which include an agent template and a prompt for the Builder. When loaded, the initialization prompt is automatically executed, making it possible for attackers to inject commands directly through the URL. This allows the malicious prompt embedded in the URL to act as the first command executed by the Builder.
Exploitation and Attack Execution
The exploit is carried out when a logged-in ChatGPT user clicks on a phishing link containing a URL crafted to include the malicious prompt. This setup requires the victim to have access to Workspace Agents and at least one authorized connector, such as Outlook or Slack. The malicious URL leverages these integrations to execute commands within the organization’s trusted environment.
The rogue AI agent can perform various unauthorized actions including creating an agent from a template, attaching connectors without user consent, and running tasks on a schedule. It can also execute tasks from specific emails and report results back to the attacker, effectively becoming a persistent insider threat.
Implications and Future Outlook
Once the rogue agent is established, it can perform reconnaissance, harvest sensitive data, and even impersonate the victim to spread further phishing attempts. Zenity Labs highlighted that this vulnerability reflects a deeper trust issue within AI platforms, where malicious agents can operate unchecked once deployed.
This discovery follows previous revelations about vulnerabilities in AI infrastructure, underscoring the ongoing challenges in securing AI systems as they become increasingly integrated into organizational operations. OpenAI’s response and the planned deprecation of the Agent Builder in favor of a more secure Agents SDK by November 30, 2026, marks a significant step towards mitigating such risks.
As AI continues to evolve, the need for robust security measures to protect against sophisticated threats like AgentForger becomes imperative. Organizations must continuously assess and enhance their security protocols to safeguard against the potential misuse of AI technologies.
