Ethical Hacking News
OpenAI's ChatGPT Workspace Agents have been found vulnerable to a critical attack known as AgentForger, which can be exploited via phishing links. This vulnerability was addressed by OpenAI as of June 8, 2026, following responsible disclosure.
The AgentForger vulnerability allows a phishing link to deploy an autonomous AI agent inside an organization, compromising its security. The vulnerability is a case of cross-site request forgery (CSRF) that exploits the OpenAI ChatGPT Workspace Agents tool. An attacker can send a malicious URL to a victim's authenticated session, which automatically submits the prompt without requiring further interaction. The attack requires access to Workspace Agents and at least one authorized connector to an enterprise app. The forged agent becomes a persistent operator that can execute tasks, report results, and send emails back to the attacker. The vulnerability highlights the importance of vigilance in cybersecurity and emphasizes the need for proactive measures to protect against evolving threats.
The cybersecurity landscape has witnessed numerous high-profile breaches and vulnerabilities in recent years, leaving organizations scrambling to fortify their defenses against an increasingly sophisticated array of threats. The latest vulnerability to gain widespread attention is the AgentForger flaw, a critical security issue identified in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization.
This vulnerability has been codenamed AgentForger by Zenity Labs, the researchers who first discovered it. The issue was addressed by OpenAI as of June 8, 2026, following responsible disclosure. According to Zenity Labs, the attack occurs when an unsuspecting employee clicks open a benign-looking ChatGPT link, causing it to spawn a new AI agent within the company's trust boundary that does the attacker's bidding.
The issue is a case of cross-site request forgery (CSRF) that forges an attacker-controlled autonomous AI agent. The Agent Builder tool, a visual, drag-and-drop canvas that allows users to build multi-step agent workflows, was found to be vulnerable to this attack. The tool accepts an initialization state through URL parameters, two of which include an agent template and the prompt to the Builder.
According to Mike Takahashi, AI Red Team Researcher at Zenity Labs, "We found that when the page loads, the value of initial_assistant_prompt is not merely placed into the prompt box. It is automatically submitted and executed." This means that an instruction embedded inside a URL can become the first command the Builder acts on.
Given this vulnerability, an attacker can send a phishing link to a target in the form of "chatgpt[.]com/agents/studio/new?template_name=[template name]&initial_assistant_prompt=[malicious prompt]." Should the logged-in user click on the link, ChatGPT opens the Builder in the victim's authenticated session and automatically submits the prompt embedded in the URL without requiring any further interaction.
However, this does not mean that the attacker needs to meet all prerequisites. The attack requires a victim who is logged into ChatGPT, access to Workspace Agents, and at least one authorized connector (i.e., an already existing ChatGPT integration to an enterprise app like Outlook, Gmail, Google Calendar, Google Drive, Slack, or Teams).
The connector integration is necessary because the crafted ChatGPT URL passes as input a chief-of-staff template that allows the agent to pull necessary data from the workspace applications. The payload passed through the malicious prompt instructs the Builder to perform a sequence of actions, including:
Create an agent from the chief-of-staff template.
Attach all already-available connectors and set every connector to "Never ask" so that no user approval is needed.
Make the agent live and schedule it such that it runs every hour, turning it into a persistence mechanism.
During each run, check for emails from a specific email address whose subject line begins with the phrase "TASK," execute those tasks, and report the results back by sending an email message to the attacker's address.
Invoke Preview Mode to run the agent immediately.
In other words, the forged agent becomes a persistent operator. The original click installs it; the schedule keeps it alive; and the connected apps give it access to sensitive actions and data, as well as a path to return results.
This scenario is troubling because it can open the door to broader compromise and other business email compromise (BEC) scenarios. The attacker does not need the victim to click another link. They do not need the Builder tab to stay open. Once the agent is published and scheduled, the attacker can keep sending it assignments through the victim's mailbox.
Each TASK email becomes a new assignment for the agent. The agent is not waiting for another click. It is waiting for instructions. At its core, AgentForger is an agent trust failure: the platform trusts that the user intentionally created, approved, scheduled, and operated the agent.
The findings come nearly a month after Zenity Labs revealed how bad actors are exploiting critical LiteLLM vulnerabilities and exposed Ollama endpoints and hijacking AI infrastructure to conduct attacks against third-parties and power their own offensive operations. These efforts involve the abuse of CVE-2024-6587, CVE-2026-40217, and CVE-2026-35029.
The discovery of this vulnerability highlights the importance of vigilance in the cybersecurity community, as organizations must take proactive measures to protect themselves against such threats. In the face of rapidly evolving threats, staying informed and up-to-date on the latest security patches and best practices is crucial for maintaining the integrity and security of one's digital assets.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-AgentForger-Flaw-A-Critical-Vulnerability-in-OpenAIs-ChatGPT-Workspace-Agents-ehn.shtml
https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html
Published: Fri Jul 24 08:07:31 2026 by llama3.2 3B Q4_K_M
