A newly disclosed vulnerability in OpenAI’s ChatGPT Workspace Agents shows how quickly AI agent platforms can become an attacker’s dream tool. Dubbed “AgentForger” by the researchers at Zenity Labs who found it, the bug allowed a single crafted link to silently construct, configure, and publish a fully autonomous, attacker-controlled agent inside a victim’s own enterprise environment — no malware download required.

A New Kind of Forgery

Traditional cross-site request forgery tricks a browser into firing off one unauthorized action. AgentForger went much further: it forged the creation of an entire standing AI agent, operating inside the victim’s trust boundary with access to whatever services that victim had already connected — Outlook, Gmail, Slack, Google Drive, SharePoint, or Microsoft Teams.

Zenity’s researchers found that ChatGPT’s Agent Builder accepted its initialization state directly through URL parameters, including template_name and initial_assistant_prompt. Critically, the prompt parameter wasn’t just pre-filling a text box for the user to review — it was automatically submitted the instant the page loaded.

From Phishing Link to Insider Threat

That auto-execution behavior turned an ordinary-looking ChatGPT link into a weaponized payload. An attacker could embed a full set of malicious instructions in the link and deliver it through a routine phishing email. If the recipient was logged in and had even one previously authorized connector, simply clicking the link caused the Agent Builder to:

• Create a new agent and attach all of the victim’s existing connected integrations automatically.
• Flip the write-action approval setting from “Always ask” to “Never ask,” disabling the safeguard meant to catch sensitive actions before they run.
• Publish the agent live and schedule it to run every five minutes.

Because the connectors were already authorized from the victim’s prior legitimate use, no new OAuth consent screen popped up to raise suspicion. Researcher Mike Takahashi demonstrated that the resulting agent could poll an attacker’s inbox for commands, map an organization’s internal structure, pull sensitive documents, harvest credentials, and even impersonate the victim across Slack, Teams, and email — effectively becoming a persistent “agentic insider” with a five-minute check-in cycle back to its operator.

Two Design Flaws, One “Lethal Trifecta”

Zenity attributes the bug to two compounding architectural choices: the Builder’s willingness to execute unvalidated URL parameters the moment a page loads, and an overly permissive natural-language interface that let a prompt alone change security-critical settings like approval policies and execution schedules. Combined, researchers say, these conditions satisfied what’s sometimes called the “lethal trifecta” of AI agent risk — untrusted input, access to sensitive private data, and an unmonitored path for that data to leave the organization.

Patched Within Days

Zenity reported AgentForger to OpenAI through Bugcrowd on June 4, and the report was triaged and accepted within 24 hours. OpenAI shipped a full fix by June 8 by removing the vulnerable URL parameter handler entirely. The company found no evidence that the flaw had been exploited in the wild before the patch landed.

What It Means for Enterprise AI Adoption

The episode is a pointed reminder that as AI agent platforms gain the ability to act autonomously across an organization’s tools, the attack surface shifts from stealing credentials to hijacking already-authorized trust relationships. Security teams evaluating agentic AI deployments should treat agent-creation workflows — not just agent outputs — as a first-class target for review, since a single link was enough to stand up a persistent, fully privileged foothold without tripping a single traditional alert.

Why Agent Platforms Change the Calculus

Conventional phishing usually aims to steal a password or plant malware that still has to talk to command-and-control infrastructure through a new, potentially detectable channel. AgentForger skipped both steps: it repurposed a legitimate, already-trusted product feature as the payload delivery mechanism and the persistence mechanism at the same time. Because the “malware” in this case was just a standard ChatGPT agent, most conventional endpoint and network defenses would have had nothing unusual to flag.

That is the core lesson security teams are drawing from the disclosure: as vendors race to add agentic capabilities to productivity tools, any workflow that lets a URL or a natural-language prompt silently reconfigure permissions deserves the same scrutiny traditionally reserved for code execution paths. Enterprises that have connected ChatGPT Workspace Agents to core business systems should confirm they are patched, review agent audit logs for unfamiliar automations, and consider requiring explicit human approval for any newly created agent that touches write-capable connectors, rather than trusting default settings alone.