A critical vulnerability in OpenAI’s ChatGPT Workspace Agents, dubbed AgentForger, that allowed a single phishing link to silently build, configure, and publish an attacker-controlled autonomous agent inside a victim’s organization.
Unlike traditional Cross-Site Request Forgery (CSRF), which forges a single unauthorized request, AgentForger forges the creation of an entire autonomous AI agent operating inside the victim’s trust boundary.
ChatGPT AgentForger Vulnerability
Workspace Agents connect to core enterprise services like Outlook, Gmail, Slack, Google Drive, SharePoint, and Microsoft Teams. Under normal operating conditions, users create these agents through an interactive conversational builder canvas.
As detailed in the technical analysis by Security researchers at Zenity Labs on AgentForger: ChatGPT Cross-Site Agent Forgery, Zenity found that this builder accepts initialization state directly through URL parameters, specifically template_name and initial_assistant_prompt.
Rather than simply populating an input box, the initial_assistant_prompt parameter is automatically submitted and executed the moment the page loads.
This design flaw allowed an attacker to embed a full set of malicious instructions inside an ordinary-looking ChatGPT link and send it as a targeted phishing email. These vectors build upon emerging device code phishing tactics that exploit trusted application flows.
When a logged-in victim with at least one pre-authorized connector clicked the link, the Builder autonomously created an agent, attached all previously connected integrations, and switched write-action approvals from “Always ask” to “Never ask,” disabling the primary safeguard meant to block silent, sensitive actions.
The forged agent was then published live and scheduled to run every five minutes, polling the attacker’s inbox for commands prefixed with "TASK" and emailing results back out, effectively turning ChatGPT into a covert command-and-control (C2) channel.
Because the connectors were already authorized from prior legitimate usage, no new OAuth consent screen appeared to alert the victim.
Researcher Mike Takahashi demonstrated that the resulting “agentic insider” could map organizational structures, exfiltrate sensitive documents, harvest credentials, and impersonate the victim across Slack, Teams, and email, mirroring tactics seen in AI-assisted phishing operations.
Zenity attributes the flaw to two combined architectural weaknesses:
- Cross-Site Auto-Execution: The Builder’s willingness to execute unvalidated URL parameters upon page load.
- Overpermissive Natural-Language Control: Allowing natural-language prompts to modify security-sensitive settings like approval policies and execution schedules.
Together, these factors satisfied what researchers call the “lethal trifecta” untrusted input, access to private data, and an unmonitored path to exfiltrate it.
| Attack Stage | Mechanism | Impact |
| Delivery | Phishing link containing crafted initial_assistant_prompt | Initial execution trigger |
| Execution | Auto-submitted prompt builds agent & attaches connectors | Unauthorized workspace access |
| Privilege Bypass | Approval setting flipped to “Never ask” | Silent action execution |
| Persistence | Recurring 5-minute schedules polling attacker inbox | Continuous C2 communication |
| Impact | Data exfiltration, credential harvesting, BEC staging | Full workspace takeover |
Zenity reported the vulnerability to OpenAI via Bugcrowd on June 4, 2026. The report was triaged and accepted within 24 hours and fully patched on June 8, 2026, by removing the vulnerable URL parameter handler.
OpenAI’s fix mitigated newly initiated attacks, and Zenity confirmed no evidence of active exploitation in the wild prior to the patch.
Zenity’s follow-up analysis highlights how a forged agent, once operational, can be tasked like a genuine attacker-controlled insider to conduct internal reconnaissance and stage business email compromise (BEC) across an enterprise.
