Security researchers at Zenity Labs have uncovered a critical vulnerability in OpenAI’s ChatGPT Workspace Agents that could have turned a single click into a full-blown insider threat. Dubbed AgentForger, the flaw allowed attackers to embed malicious instructions inside a seemingly harmless ChatGPT URL, automatically building and deploying an autonomous AI agent that answered to the attacker, not the employee .
According to Zenity, All it took was one click. An employee opened a normal-looking ChatGPT link, and without a single confirmation or approval prompt, a new AI agent began running inside their organization’s trust boundary . Unlike traditional attacks that steal passwords or browser sessions, AgentForger created a persistent “agentic insider” that fully inherited the victim’s identity and access to connected enterprise apps .
“This isn’t a forged request, it’s a forged insider,” said Michael Bargury, CTO of Zenity. “With one click, an attacker gets a fully autonomous agent inside your company that has your people’s identity and access, with the guardrails off. Attackers no longer have to break in to steal your data. They can forge an insider to go get it for them.”
How AgentForger Worked
The Vulnerability
ChatGPT’s Workspace Agent Builder lets users create AI agents that connect to enterprise apps like Outlook, Gmail, Slack, Teams, SharePoint, and Google Drive. The normal flow is interactive users choose templates, write prompts, review configurations, and publish. But Zenity found that the builder could be driven entirely through URL parameters.
Two parameters were the key:
1. template_name: selected a starter template (e.g., “Chief of Staff” for powerful default capabilities)
2. initial_assistant_prompt: supplied instructions that were automatically submitted and executed when the page loaded
This meant an attacker could craft a link like:
chatgpt.com/agents/studio/new?template_name=chief-of-staff&initial_assistant_prompt=[attacker's instructions]
When a logged-in victim clicked it, the builder would create an agent according to the attacker’s specifications – without any further interaction.
The Payload
The attacker’s prompt could instruct the builder to:
- Attach all already-connected connectors (Outlook, Gmail, Slack, etc.)
- Set connectors to “Never ask” disabling approval requirements for read, write, and delete actions
- Schedule the agent with recurring tasks (e.g., every 5 minutes) to create a persistent command-and-control channel
- Check the victim’s inbox for emails with “TASK” in the subject line
- Execute those commands and email results back to the attacker unredacted
The builder treated this as a to-do list and worked through it autonomously. Preview Mode then executed the agent immediately.
The Blast Radius: From Phish to Full Compromise
Once published and scheduled, the forged agent became a permanent foothold. The attacker could send TASK emails to the victim’s inbox, and the agent would execute those instructions never needing the victim to click another link.
Zenity’s proof-of-concept scenarios demonstrated a terrifying range of capabilities:
- Reconnaissance: mapping the organization’s people, projects, and data by trawling Outlook, Slack, Teams, and cloud storage
- Data Harvesting: pulling sensitive documents, spreadsheets, and internal memos
- Credential Theft: searching for passwords and API keys in chat messages and emails
- Impersonation: sending convincing phishing messages through the victim’s own Teams or email accounts
- Business Email Compromise: using the victim’s identity to request wire transfers or sensitive information
As Zenity put it: “The attacker now has an autonomous insider operating inside the organization’s trust boundary.”
The Root Causes
Zenity identified two flaws that made AgentForger possible :
1. Cross-site auto-execution. The builder treated the initial_assistant_prompt parameter as executable input, not user content requiring confirmation. This created a classic CSRF vulnerability but with a twist.
2. Security configuration exposed to natural language. The same prompt could modify approval policies and execution schedules. The mechanism intended to require human approval could itself be disabled by the instructions being executed .
Together, these created a “lethal trifecta”: untrusted input (the URL), access to private data (the connectors), and a way to exfiltrate (send mail).
MEA Perspective: Why This Matters in the Middle East & Africa
The Middle East and Africa are rapidly adopting AI tools across government and enterprise sectors. The UAE’s AI Strategy 2031 and Saudi Arabia’s Vision 2030 both emphasize AI integration but with this comes exposure to emerging threats like AgentForger.
For MEA organizations:
- Government agencies using ChatGPT Workspace for internal workflows could have seen forged agents compromise sensitive state information
- Financial institutions in the Gulf – early adopters of AI – could have faced credential theft and business email compromise at scale
- SMEs in Africa with limited security resources might not have detected these invisible agents until significant damage occurred
The vulnerability is patched, but the attack surface remains. Any organization deploying autonomous AI agents becomes a potential target.
10 Actions for Security Teams
While OpenAI patched AgentForger (within four days of disclosure) , the attack pattern remains relevant for any platform with agent builders. Here are 10 recommended actions:
– Discovery & Inventory
1. Inventory all ChatGPT Workspace Agents in your tenant. Check who created them, what connectors they use, and what schedules are active. Assume any agent created before June 8, 2026 (patch date) could be compromised.
2. Review OAuth and connector grants. Revoke stale or unnecessary authorizations. The attack relied on pre-existing connectors if they weren’t there, the agent couldn’t act.
– Configuration & Hardening
3. Set approval defaults to “Always ask” for write/delete actions. Agents should not be able to silently send emails or modify files.
4. Disable “create agent from URL” features where possible. If not, ensure all URL parameters are validated and require user confirmation.
5. Implement least-privilege for connectors. Each agent should only have access to apps and data it absolutely needs — not the full set of user connectors.
– Detection & Monitoring
6. Monitor for unexpected new agents. Alert on the creation of Workspace Agents, especially those published immediately after creation.
7. Watch for approval policy changes. Any switch from “Always ask” to “Never ask” on connectors should trigger an investigation.
8. Track scheduled agent activity. Agents with frequent schedules or anomalous execution patterns are a red flag .
– Governance
9. Add Workspace Agents to quarterly access reviews. Treat them like privileged service accounts – with owners, justification, and regular recertification.
10. Train employees on “ChatGPT link” risks. A link that looks like a legitimate ChatGPT URL can now be a privileged action surface. Include this in phishing simulations.
Disclosure Timeline
Zenity responsibly disclosed AgentForger to OpenAI through Bugcrowd on June 4, 2026. OpenAI acknowledged the report within one day and fixed the vulnerability within four days by June 8, the risky URL parameter was removed . There is no evidence that AgentForger was exploited in the wild before the patch.
Conclusion
AgentForger represents a fundamental shift in how we think about cyberattacks. It’s no longer just about stealing credentials or infecting systems it’s about forging an autonomous insider that operates with legitimate identity and access.
As AI agents become more capable and ubiquitous, the attack surface expands dramatically. The security community must adapt not just by patching vulnerabilities, but by rethinking how we trust and monitor autonomous systems.
As Bargury put it: “This is an agent trust failure, and existing security controls were never built to see it.”
