A significant vulnerability identified in OpenAI’s ChatGPT Workspace Agents, named AgentForger, allowed attackers to deploy autonomous agents within a target organization using a crafted phishing link.
Understanding the AgentForger Exploit
Unlike traditional Cross-Site Request Forgery (CSRF) attacks, which enable unauthorized single requests, the AgentForger flaw enabled the creation of fully autonomous AI agents within a victim’s trusted environment. These agents connected with enterprise services such as Outlook, Gmail, Slack, Google Drive, and Microsoft Teams.
According to Zenity Labs, the vulnerability stemmed from the builder’s interactive conversational interface, which accepted URL parameters like template_name and initial_assistant_prompt. The latter would execute upon page load, allowing malicious instructions to be embedded in seemingly innocuous links.
Exploitation and Consequences
Upon clicking a malicious link, a logged-in user would trigger the automatic creation of an agent that could integrate with existing connectors and modify settings to bypass critical security safeguards. This included changing action approvals from “Always ask” to “Never ask,” facilitating silent execution of sensitive actions.
Once live, these agents communicated with the attacker, executing tasks and exfiltrating data without alerting the victim. Demonstrated by researcher Mike Takahashi, these agents could map organizational structures, steal credentials, and impersonate users, mirroring tactics used in AI-assisted phishing.
OpenAI’s Quick Response and Mitigation
Zenity Labs reported the vulnerability to OpenAI on June 4, 2026. OpenAI responded swiftly, patching the issue by June 8, 2026, through the removal of the vulnerable URL parameter handler. This patch prevented any new attacks from exploiting this specific vulnerability.
Zenity confirmed that no evidence of active exploitation was found prior to the patch. Their follow-up analysis highlighted the potential for a forged agent to conduct internal reconnaissance and facilitate business email compromise (BEC) attacks, underscoring the importance of swift mitigation.
This incident emphasizes the need for robust security measures and vigilance in enterprise environments to protect against evolving threats. Organizations are encouraged to integrate advanced threat detection tools to bolster their security operations center (SOC) and enhance their response capabilities.
