It was a single malicious link that could have let an attacker spin up an autonomous AI agent inside a victim’s organization. That’s the core of the ChatGPT AgentForger vulnerability, a flaw disclosed by Zenity Labs and patched by OpenAI on June 8, 2026. The issue let a phishing email silently build, authorize, and deploy a rogue Workspace Agent, giving the attacker the same access as a real employee.
Key Takeaways
- One crafted URL could auto‑create a persistent AI agent in a logged‑in OpenAI session.
- The exploit relies on a CSRF weakness that auto‑submits prompts embedded in URL parameters.
- Successful exploitation requires a victim with Workspace Agent access and at least one authorized connector.
- OpenAI has patched the flaw, but the deprecation of Agent Builder by November 30, 2026, signals a shift toward the Agents SDK.
- Enterprises should audit connector permissions and enforce MFA for ChatGPT sessions.
Historical Context and Precedents
The AI‑driven tooling landscape has been evolving for several years. Early chatbot platforms offered simple text‑only interactions, and security concerns were limited to credential leakage. As providers introduced richer integrations—email, calendar, and messaging connectors—attackers began to explore ways to abuse those pathways. Prior to 2026, several public disclosures highlighted cross‑site request forgery (CSRF) attacks that could manipulate web‑based admin consoles. Those cases taught developers that a URL is more than a navigation shortcut; it can carry commands that execute without user confirmation.
Within the OpenAI ecosystem, the Workspace Agent feature was launched to let non‑technical users create autonomous assistants through a visual Builder. That convenience introduced a new attack surface: the Builder UI accepts parameters via the query string. When the Builder auto‑populates fields, it also triggers the underlying API calls. The AgentForger vulnerability is a direct descendant of those earlier CSRF patterns, but it amplifies the impact by granting the attacker full agent privileges.
In parallel, other cloud‑based AI services experimented with SDKs that require code‑level interaction. Those SDKs typically enforce stricter authentication and audit trails, which is why OpenAI’s announced migration away from the Builder UI aligns with industry trends toward programmatic control. The historical shift from UI‑centric creation to SDK‑driven pipelines reflects a broader effort to shrink the attack surface.
ChatGPT AgentForger vulnerability: How a single link could hijack Workspace Agents
When a user clicked a seemingly benign ChatGPT link, the Builder opened in their authenticated session and instantly submitted the embedded prompt. That’s how the attack chain started, and it’s a classic case of cross‑site request forgery (CSRF) that forges an autonomous AI agent. The malicious URL follows a pattern like chatgpt.com/agents/studio/new?template_name=[template]&initial_assistant_prompt=[payload]. If the victim is logged in, the Builder treats the initial_assistant_prompt not as a simple text field but as an immediate command.
Why the URL matters
Zenity’s testing showed the Builder accepts an initialization state through URL parameters, including a template and the prompt. “We found that when the page loads, the value of initial_assistant_prompt is not merely placed into the prompt box. It is automatically submitted and executed,” AI Red Team Researcher Mike Takahashi told original report. That’s the catch: the URL itself becomes the first command the Builder acts on.
Step‑by‑step of the attack chain
The payload coerces the Builder to create an agent from the chief‑of‑staff template, attach every existing connector, set each connector to “Never ask,” and schedule the agent to run hourly. Then it tells the agent to watch the victim’s mailbox for emails with subjects starting with “TASK” and to execute whatever commands those emails contain. Finally, the payload invokes Preview Mode to run the agent immediately.
Key actions the forged agent performs
- Create an agent from the chief‑of‑staff template.
- Attach all authorized connectors (Outlook, Gmail, Slack, Teams, etc.).
- Set every connector to “Never ask” to bypass user approvals.
- Make the agent live and schedule hourly execution.
- Monitor the mailbox for “TASK” emails and act on them.
- Execute a preview run that actually performs the actions.
In other words, the forged agent becomes a persistent operator. The original click installs it; the schedule keeps it alive; and the connected apps give it a source of commands, access to sensitive actions and data, as well as a path to return results.
Potential impact on compromised organizations
Once inside, the rogue agent can harvest documents from cloud storage, scrape passwords from Slack messages, and even impersonate the victim to send phishing links on Teams. Those links could redirect recipients to fake Microsoft login pages, opening the door to broader business email compromise (BEC) scenarios. “The attacker does not need the victim to click another link,” Takahashi explained. “They do not need the Builder tab to stay open. Once the agent is published and scheduled, the attacker can keep sending it assignments through the victim’s mailbox.” That’s a serious escalation path.
Beyond credential theft, the agent can exfiltrate intellectual property by copying files to external storage endpoints. Because the agent runs under the same permissions as a legitimate employee, data‑loss‑prevention tools may not flag its activity. The covert nature of the scheduled runs also means that security analysts could miss the malicious behavior for days, especially if monitoring dashboards focus on user‑initiated actions rather than automated tasks.
Technical Architecture of Workspace Agents
Workspace Agents sit at the intersection of OpenAI’s language models and enterprise connectors. When an agent is created, the Builder registers it in the OpenAI backend, links each approved connector, and stores the configuration in a tenant‑specific datastore. Execution proceeds via a runtime that pulls the agent’s prompt, resolves connector credentials, and then calls the language model to generate actions. The runtime respects the connector’s approval settings, which is why the “Never ask” flag is so powerful: it eliminates interactive consent checks.
Each hourly run spawns a short‑lived process that authenticates to the connected services using OAuth tokens previously granted by the user. Those tokens are cached in memory and discarded after the run, limiting persistent credential exposure. However, the cached tokens give the agent full API access for the duration of the run, which is exactly what the forged agent exploits. Understanding this flow helps defenders pinpoint where to insert verification steps, such as short‑lived token issuance or additional MFA challenges for scheduled jobs.
OpenAI’s response and the upcoming deprecation
OpenAI addressed the flaw on June 8, 2026, after Zenity Labs responsibly disclosed it. The company also announced that Agent Builder will be deprecated on November 30, 2026, urging users to migrate to the Agents SDK. While the patch closes the immediate CSRF vector, the deprecation timeline suggests OpenAI is moving away from a UI‑driven agent creation model in favor of programmatic SDK usage.
“In this flow, however, Preview is not just a visual preview or dry run. It executes the newly created agent against the victim’s connected accounts using the approval settings that have just been configured,” Zenity explained.
What enterprises can do now
First, audit who has access to Workspace Agents and revoke unnecessary permissions. Second, enforce multi‑factor authentication for all ChatGPT sessions to make it harder for a stolen session cookie to be used. Third, review connector settings and disable the “Never ask” option wherever possible. Finally, monitor for unexpected agent creations or scheduled runs in the OpenAI admin console.
What This Means For You
If you’re a developer building on OpenAI’s platform, you need to treat any URL that can launch a Builder session as untrusted input. Validate and sanitize any parameters you might forward to ChatGPT, and consider disabling the Builder UI entirely in production environments. For security teams, adding detection rules for the specific URL pattern and the hourly scheduling behavior can catch attempts before they gain persistence.
For founders, the incident underscores the risk of granting AI tools deep integration with corporate data without strong oversight. You should design policies that require manual review before any AI‑generated agent can be set to “Never ask” or scheduled for recurrent execution.
Consider three concrete scenarios. First, a SaaS startup that uses Slack connectors to automate ticket triage could see a rogue agent silently create tickets that contain malicious payloads. Second, a consultancy that relies on Outlook connectors for calendar management might have its meeting invites hijacked to include fake links, leading clients to credential‑phishing sites. Third, an internal dev‑ops team that uses Teams connectors for deployment notifications could inadvertently expose deployment keys if a forged agent reads and forwards those messages.
In each case, the core mitigation is the same: enforce strict permission boundaries, require human approval for any connector that can act without prompts, and keep an eye on the agent lifecycle dashboard. The shift to the Agents SDK may simplify enforcement because code‑level checks can be baked into the development pipeline, reducing reliance on UI‑based safeguards.
Will the SDK model eliminate this class of attacks? It reduces the surface area, but any system that can execute code on behalf of a user remains a target. Continuous monitoring and a defense‑in‑depth approach stay vital.
Key Questions Remaining
How will organizations balance the convenience of autonomous agents with the need for granular audit trails? What new controls will the Agents SDK introduce to prevent unauthorized connector usage? Can future OpenAI updates provide built‑in verification steps for scheduled runs without breaking existing workflows? These questions will shape the next round of security guidance.
Answering them will require collaboration between AI product teams, enterprise security officers, and compliance auditors. The community will likely see new best‑practice documents that outline recommended token lifetimes, mandatory MFA for agent creation, and regular reviews of connector permissions. Until those standards mature, the safest posture is to treat every automated assistant as a privileged user and to watch its activity closely.
Sources: The Hacker News, original report
