Critical "AgentForger" Vulnerability in ChatGPT Workspace Agents Allowed Rogue AI Agent Deployment
2026-07-27 05:24:36
Security researchers have disclosed a critical vulnerability, dubbed AgentForger, that previously allowed attackers to deploy malicious autonomous AI agents inside an organization's ChatGPT Workspace environment through a single phishing link.
The vulnerability affected OpenAI's ChatGPT Workspace Agents and was discovered by researchers at Zenity Labs. OpenAI has confirmed the issue was responsibly reported and has since been fully patched.
Phishing Link Could Create Autonomous AI Agents
According to Zenity's technical analysis, the vulnerability exploited the ChatGPT Agent Builder, which allows users to create AI agents connected to enterprise services such as Microsoft Outlook, Gmail, Slack, Google Drive, Microsoft Teams, and SharePoint.
Researchers found that the Agent Builder accepted initialization data through URL parameters, including template_name and initial_assistant_prompt. Instead of simply displaying the provided prompt, the application automatically executed it as soon as the page loaded.
An attacker could therefore embed a complete set of malicious instructions inside a seemingly legitimate ChatGPT link and distribute it through a targeted phishing email.
If a logged-in employee with previously authorized workspace integrations clicked the link, the builder would automatically generate a new AI agent using the attacker's instructions.
Security Settings Could Be Modified Automatically
The attack became particularly dangerous because the forged agent inherited all previously authorized enterprise connectors without requesting additional OAuth permissions.
Researchers demonstrated that the malicious prompt could also modify security-sensitive configuration options, including changing action approval settings from "Always ask" to "Never ask", effectively removing one of the platform's primary safeguards against unauthorized actions.
The rogue agent could then be automatically published and configured to execute on a recurring schedule without further user interaction.
Persistent Command-and-Control Capability
Zenity researchers showed that the deployed agent could be instructed to poll an attacker-controlled mailbox every five minutes for commands beginning with the keyword "TASK".
The agent would execute those commands using its authorized enterprise integrations and return the results via email, effectively transforming ChatGPT Workspace into a covert command-and-control (C2) channel.
With access to existing enterprise connectors, a compromised agent could potentially:
Map organizational structures and internal relationships.
Access and exfiltrate sensitive corporate documents.
Collect authentication credentials.
Interact with Slack, Microsoft Teams, and email accounts while impersonating the affected user.
Support Business Email Compromise (BEC) campaigns.
Root Cause
Researchers attribute the vulnerability to two architectural weaknesses working together:
Automatic execution of untrusted URL parameters within the ChatGPT Agent Builder.
Overly permissive natural-language controls, allowing prompts to modify security-sensitive settings such as approval policies and execution schedules.
According to Zenity, this combination created a highly effective attack chain by enabling untrusted input, granting access to enterprise data, and providing a mechanism for persistent data exfiltration.
Patch Released
Zenity reported the vulnerability to OpenAI through Bugcrowd on June 4, 2026. The report was acknowledged within 24 hours, and OpenAI released a complete fix on June 8, 2026 by removing the vulnerable URL parameter processing mechanism.
Researchers stated that they found no evidence of active exploitation before the vulnerability was patched.
Recommendations
Organizations using ChatGPT Workspace should continue to follow security best practices, including reviewing connected workspace integrations, limiting unnecessary connector permissions, monitoring AI agent activity, and providing employees with phishing awareness training.
The AgentForger research highlights a growing challenge for enterprise AI platforms: as autonomous AI agents gain deeper access to business systems, securing the agent creation process becomes just as important as protecting user accounts themselves.
The vulnerability affected OpenAI's ChatGPT Workspace Agents and was discovered by researchers at Zenity Labs. OpenAI has confirmed the issue was responsibly reported and has since been fully patched.
Phishing Link Could Create Autonomous AI Agents
According to Zenity's technical analysis, the vulnerability exploited the ChatGPT Agent Builder, which allows users to create AI agents connected to enterprise services such as Microsoft Outlook, Gmail, Slack, Google Drive, Microsoft Teams, and SharePoint.
Researchers found that the Agent Builder accepted initialization data through URL parameters, including template_name and initial_assistant_prompt. Instead of simply displaying the provided prompt, the application automatically executed it as soon as the page loaded.
An attacker could therefore embed a complete set of malicious instructions inside a seemingly legitimate ChatGPT link and distribute it through a targeted phishing email.
If a logged-in employee with previously authorized workspace integrations clicked the link, the builder would automatically generate a new AI agent using the attacker's instructions.
Security Settings Could Be Modified Automatically
The attack became particularly dangerous because the forged agent inherited all previously authorized enterprise connectors without requesting additional OAuth permissions.
Researchers demonstrated that the malicious prompt could also modify security-sensitive configuration options, including changing action approval settings from "Always ask" to "Never ask", effectively removing one of the platform's primary safeguards against unauthorized actions.
The rogue agent could then be automatically published and configured to execute on a recurring schedule without further user interaction.
Persistent Command-and-Control Capability
Zenity researchers showed that the deployed agent could be instructed to poll an attacker-controlled mailbox every five minutes for commands beginning with the keyword "TASK".
The agent would execute those commands using its authorized enterprise integrations and return the results via email, effectively transforming ChatGPT Workspace into a covert command-and-control (C2) channel.
With access to existing enterprise connectors, a compromised agent could potentially:
Map organizational structures and internal relationships.
Access and exfiltrate sensitive corporate documents.
Collect authentication credentials.
Interact with Slack, Microsoft Teams, and email accounts while impersonating the affected user.
Support Business Email Compromise (BEC) campaigns.
Root Cause
Researchers attribute the vulnerability to two architectural weaknesses working together:
Automatic execution of untrusted URL parameters within the ChatGPT Agent Builder.
Overly permissive natural-language controls, allowing prompts to modify security-sensitive settings such as approval policies and execution schedules.
According to Zenity, this combination created a highly effective attack chain by enabling untrusted input, granting access to enterprise data, and providing a mechanism for persistent data exfiltration.
Patch Released
Zenity reported the vulnerability to OpenAI through Bugcrowd on June 4, 2026. The report was acknowledged within 24 hours, and OpenAI released a complete fix on June 8, 2026 by removing the vulnerable URL parameter processing mechanism.
Researchers stated that they found no evidence of active exploitation before the vulnerability was patched.
Recommendations
Organizations using ChatGPT Workspace should continue to follow security best practices, including reviewing connected workspace integrations, limiting unnecessary connector permissions, monitoring AI agent activity, and providing employees with phishing awareness training.
The AgentForger research highlights a growing challenge for enterprise AI platforms: as autonomous AI agents gain deeper access to business systems, securing the agent creation process becomes just as important as protecting user accounts themselves.