AgentForger Flaw: Single Phishing Link Could Deploy Rogue ChatGPT Workspace Agents

Cybersecurity researchers at Zenity Labs have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents, codenamed AgentForger, that allowed a single phishing link to silently build, authorize, and deploy an autonomous AI agent inside a victim's organization. Disclosed by AI Red Team Researcher Mike Takahashi, the flaw exploited a cross-site request forgery (CSRF) weakness in Agent Builder—a visual, drag-and-drop canvas used to construct multi-step agent workflows. OpenAI addressed the issue on June 8, 2026, following responsible disclosure, though the company separately announced last month that it will deprecate Agent Builder effective November 30, 2026, urging migration to the Agents SDK.

The attack hinged on Agent Builder accepting an initialization state through URL parameters, specifically template_name and initial_assistant_prompt. According to Takahashi, "when the page loads, the value of initial_assistant_prompt is not merely placed into the prompt box. It is automatically submitted and executed," meaning an instruction embedded in a URL becomes the first command the Builder acts on. A logged-in employee tricked into clicking a crafted link following the pattern chatgpt[.]com/agents/studio/new?template_name=[template]&initial_assistant_prompt=[malicious prompt] would have the malicious prompt auto-executed inside their authenticated ChatGPT session, with no further user interaction required. Organizations can verify suspicious domains targeting their workforce using our WHOIS lookup tool.

For the exploit to succeed, an attacker needed the victim to be logged into ChatGPT, hold access to Workspace Agents, and have at least one pre-authorized connector to an enterprise application such as Outlook, Gmail, Google Calendar, Google Drive, Slack, or Teams. The payload instructed Agent Builder to instantiate a chief-of-staff template—a legitimate workflow that pulls data from connected workspace apps to produce a "high-signal operating brief"—then attach every available connector to the newly created agent while bypassing approval prompts. The result was an attacker-controlled AI agent operating within the company's trust boundary, carrying the access rights of a real employee and capable of exfiltrating or manipulating sensitive corporate data. Security teams can audit exposed integrations and session hygiene via our privacy checkup.

Zenity Labs described the implications starkly: "A single link could hijack OpenAI's ChatGPT Agent Builder to stand up an attacker-controlled AI agent with a real employee's access and its approvals switched off." Employees targeted through this technique should be reminded to verify any unsolicited ChatGPT links before clicking, and administrators should review connector assignments and agent creation logs for anomalies. With Agent Builder's deprecation on the horizon, organizations should also accelerate their migration to the Agents SDK and audit existing workflows for similar trust-boundary issues, particularly any process that auto-executes prompts derived from URL parameters. Admins can validate their enterprise domain's transport security posture with our SSL/TLS checker.