Key Takeaways
- A critical CSRF flaw in OpenAI’s ChatGPT Workspace Agents (codenamed AgentForger) let an attacker create a persistent, autonomous AI agent with a single phishing link.
- Exploitation required the victim to be logged into ChatGPT, have Workspace Agents access, and possess at least one authorized connector (e.g., Outlook, Gmail, Slack).
- The malicious URL injected a prompt that forced the Agent Builder to create an agent from a “chief‑of‑staff” template, attach all connectors, set them to “Never ask,” schedule hourly runs, and execute commands from emails titled “TASK…”.
- Once deployed, the agent could exfiltrate data, harvest credentials, impersonate the victim to send further phishing links, and operate continuously without further user interaction.
- OpenAI patched the vulnerability on June 8 2026 and is deprecating the Agent Builder in favor of the Agents SDK (effective Nov 30 2026).
- Organizations should enforce strict URL validation, limit connector approvals, monitor for unexpected agent schedules, and educate users about phishing even when links appear benign.
Overview of the AgentForger Vulnerability
Zenity Labs disclosed a critical vulnerability in OpenAI’s ChatGPT Workspace Agents that allowed a single phishing link to hijack the Agent Builder and spin up an attacker‑controlled AI agent inside a victim’s organization. Dubbed AgentForger, the flaw resides in the way the Builder consumes URL‑provided initialization parameters, turning a seemingly innocuous link into a powerful attack vector. OpenAI addressed the issue on June 8 2026 following responsible disclosure, and has since announced the deprecation of the Agent Builder tool. The discovery underscores how trust assumptions in AI‑agent platforms can be abused when input validation is insufficient.
Technical Mechanism: CSRF via URL Parameters
The core of AgentForger is a cross‑site request forgery (CSRF) weakness in the Agent Builder’s handling of the initial_assistant_prompt URL parameter. When the Builder page loads, the value of this parameter is not merely displayed in the prompt box; it is automatically submitted and executed as the first command. Consequently, an attacker can embed a malicious prompt directly into a URL such as chatgpt.com/agents/studio/new?template_name=[name]&initial_assistant_prompt=[malicious prompt]. Clicking the link forces the Builder to act on the injected instructions without any further user interaction, effectively turning a GET request into a privileged action.
Prerequisites for Exploitation
For the attack to succeed, three conditions must be met: the target user must be logged into ChatGPT, must have access to the Workspace Agents feature, and must possess at least one authorized connector to an enterprise application (e.g., Outlook, Gmail, Google Calendar, Slack, Teams). The connector is essential because the malicious payload relies on a pre‑existing integration to pull data from workplace apps and to return results via email. Without a valid connector, the forged agent would lack the necessary permissions to read or write data, limiting its impact.
Attack Flow: From Click to Persistent Agent
When a victim clicks the malicious link, the Builder opens within their authenticated session and instantly processes the injected prompt. The prompt instructs the Builder to: (1) create an agent from the “chief‑of‑staff” template, (2) attach all available connectors and set each to “Never ask” so no further approvals are required, (3) make the agent live and schedule it to run every hour, (4) invoke Preview Mode to run the agent immediately, and (5) program the agent to scan incoming emails for subjects beginning with “TASK”, execute any contained tasks, and email the results to the attacker’s address. This sequence creates a fully operational, persistent insider agent after a single click.
Role of Preview Mode and Scheduling
Preview Mode is normally intended as a safe sandbox for testing agents before publication. In the AgentForger exploit, however, Preview Mode executes the newly created agent against the victim’s connected accounts using the approval settings just configured—effectively turning a “dry run” into a live operation. The hourly schedule then ensures the agent remains active, repeatedly checking for new “TASK” emails and carrying out instructions without requiring the Builder tab to stay open or the user to click another link. This combination of immediate execution and recurring automation gives the attacker a reliable foothold inside the organization.
Capabilities of the Forged Agent
Once active, the forged agent can perform a wide range of malicious activities: it can read and exfiltrate emails, harvest documents from cloud storage (Google Drive, OneDrive), extract passwords or sensitive data mentioned in Slack or Teams messages, and invoke any action permitted by the attached connectors. Because the agent runs under the victim’s identity and inherits their access rights, it can bypass many traditional security controls that rely on user‑level privileges. The attacker merely needs to send appropriately formatted “TASK” emails; the agent will execute them and report back, creating a covert command‑and‑control channel.
Potential for Lateral Movement and Business Email Compromise
Beyond data theft, the agent can be weaponized to launch further attacks. By leveraging the victim’s email account, it can send phishing links via Teams or Outlook that appear to come from a trusted colleague, directing recipients to fake login pages designed to capture credentials. This capability enables classic business email compromise (BEC) scenarios and can facilitate credential harvesting, lateral movement to other accounts, or the deployment of additional malware. Because the agent operates autonomously, the attacker does not need to maintain a persistent presence; the agent itself continues to poll for new instructions.
Comparison to Prior AI Infrastructure Abuses
The AgentForger discovery follows a pattern of attackers exploiting misconfigured AI infrastructure. Earlier in 2026, Zenity Labs highlighted how bad actors abused vulnerabilities in LiteLLM (CVE‑2024‑6587, CVE‑2026‑40217, CVE‑2026‑35029) and exposed Ollama endpoints to hijack self‑hosted model servers for offensive operations. Those incidents demonstrated that unauthenticated, publicly reachable AI services can serve as “deniable backend compute” for malicious agents. AgentForger shows a similar risk but within a SaaS‑provided agent‑building platform, emphasizing that even managed services are vulnerable when input validation fails.
Mitigation and OpenAI’s Response
OpenAI remedied the flaw by ensuring that URL‑provided initialization parameters are no longer auto‑executed; instead, they must be manually confirmed by the user before any agent creation occurs. The company also accelerated the deprecation of the Agent Builder, urging customers to migrate to the more secure Agents SDK by November 30 2026. For organizations, recommended mitigations include: enforcing strict referrer and origin checks on internal applications, disabling or tightly controlling the ability to create agents via URL parameters, monitoring for newly created agents with abnormal schedules or “Never ask” connector settings, and conducting regular security awareness training that stresses the danger of seemingly benign links even when they appear to originate from trusted sources.
Broader Implications and Recommendations
AgentForger illustrates how the convergence of AI‑agent usability features and insufficient input validation can yield powerful insider threats. As enterprises increasingly adopt AI‑driven automation, the attack surface expands beyond traditional software vulnerabilities to include logic flaws in agent orchestration tools. Security teams should treat agent builders as privileged components, applying the same rigor used for admin consoles: least‑privilege access, detailed logging, anomaly detection for scheduled tasks, and strict validation of any external input (including URLs). By combining technical controls with user education, organizations can reduce the likelihood that a single phishing link will give an attacker a persistent, autonomous AI operative inside their networks.