A critical security flaw in OpenAI's ChatGPT Workspace Agents could have allowed attackers to deploy autonomous AI agents inside a victim's organization using nothing more than a phishing link. The vulnerability, discovered by Zenity Labs and codenamed AgentForger, has since been patched by OpenAI as of June 8, 2026, but the incident reveals how quickly AI tools can become targets for sophisticated attacks when security controls aren't airtight.

How Does the AgentForger Vulnerability Work?

The flaw exploited a cross-site request forgery (CSRF) vulnerability in ChatGPT's Agent Builder, a visual tool that lets users create multi-step AI agent workflows. When an unsuspecting employee clicked on a specially crafted phishing link, the vulnerability would automatically execute a malicious prompt without requiring any additional interaction from the user.

The attack worked by embedding instructions directly into a URL that the Agent Builder would automatically process. Once the page loaded in an authenticated session, the builder would instantly submit the embedded prompt and execute it, creating what researchers called a "persistent operator" inside the company's systems.

What Could the Rogue Agent Actually Do?

Once deployed, the forged agent could perform a chilling range of malicious activities. The attacker's instructions would cause the agent to attach itself to all existing workplace connectors, such as Outlook, Gmail, Google Calendar, Google Drive, Slack, or Microsoft Teams, and set every connector to "Never ask" mode, meaning no user approval would be needed for any action.

From there, the rogue agent could operate autonomously on a scheduled basis, checking for emails from the attacker with specific subject lines beginning with "TASK" and executing those instructions. The agent could then report results back to the attacker's email address, creating a persistent backdoor inside the organization.

• Reconnaissance and Data Theft: The agent could burrow deeper into the organization, harvesting sensitive documents from cloud storage services and stealing passwords mentioned in Slack messages.
• Impersonation and Phishing: The rogue agent could impersonate the victim employee to send phishing links on Microsoft Teams to other employees, redirecting them to fake login pages designed to steal their credentials.
• Persistent Access: Once published and scheduled, the attacker didn't need the victim to click another link or keep the Builder tab open; the agent would remain active and wait for new task assignments through the victim's mailbox.
• Business Email Compromise: The capability to impersonate employees and send phishing messages could open the door to broader organizational compromise and other business email compromise (BEC) scenarios.

"A single link could hijack OpenAI's ChatGPT Agent Builder to stand up an attacker-controlled AI agent with a real employee's access and its approvals switched off," stated Zenity Labs.

Zenity Labs, AI Security Company

What Prerequisites Did Attackers Need?

The vulnerability wasn't a complete free-for-all; attackers needed to meet specific conditions for the attack to succeed. The victim had to be logged into ChatGPT, have access to Workspace Agents, and critically, have at least one authorized connector already set up to an enterprise application.

This last requirement was essential because the malicious payload used a chief-of-staff template that needed to pull data from workplace applications to function. However, in many modern enterprises where ChatGPT integration is common, these connectors are already in place, making the attack viable against a significant portion of potential targets.

How Did Researchers Discover This?

Mike Takahashi, an AI Red Team Researcher at Zenity Labs, explained the mechanics of how the vulnerability worked. He noted that the Agent Builder accepted an initialization state through URL parameters, and when the page loaded, the value of the initial assistant prompt wasn't simply placed into the prompt box; it was automatically submitted and executed.

"That means an instruction embedded inside a URL can become the first command the Builder acts on," explained Mike Takahashi, AI Red Team Researcher at Zenity Labs.

Mike Takahashi, AI Red Team Researcher at Zenity Labs

Takahashi further emphasized the persistence problem: "The attacker does not need the victim to click another link. They do not need the Builder tab to stay open. Once the agent is published and scheduled, the attacker can keep sending it assignments through the victim's mailbox. Each TASK email becomes a new assignment for the agent. The agent is not waiting for another click. It is waiting for instructions".

What Does This Mean for AI Security Going Forward?

At its core, AgentForger represents what researchers call an "agent trust failure," where the platform trusted that a user intentionally created, approved, scheduled, and operated the agent, without verifying that the user actually intended to do so. This highlights a broader challenge in AI security: as autonomous agents become more powerful and integrated into enterprise workflows, the attack surface expands dramatically.

The timing of this disclosure is significant. OpenAI announced in July 2026 that it would be deprecating the Agent Builder product effective November 30, 2026, urging users to switch to the Agents SDK instead. This suggests the company recognized broader security challenges with the tool and decided to sunset it in favor of a more secure alternative.

The AgentForger vulnerability also comes amid a broader wave of AI infrastructure attacks. Zenity Labs noted that self-hosted model servers and agent frameworks continue to be deployed while misconfigured and unauthenticated on predictable ports, turning exposed AI infrastructure into convenient backends for offensive AI agents. This pattern suggests that as AI tools proliferate in enterprise environments, security practices haven't kept pace with the technology's rapid advancement.