Discovery of the AgentForger Vulnerability

Security researchers at Zenity Labs identified a critical flaw in OpenAI’s ChatGPT Workspace Agents, specifically within the Agent Builder tool used by companies to create workflow-enabled agents in their internal ChatGPT environments. Named AgentForger, the issue allowed external attackers to install a fully autonomous AI agent tied to a legitimate employee’s account and privileges through one carefully constructed link.

The vulnerability relied on two URL parameters during the Agent Builder’s initialization process. One parameter selected the agent template, which defaulted to a highly privileged “Chief of Staff” agent. The second, called initial_assistant_prompt, accepted instructions that the system applied automatically upon loading. When combined, these parameters produced a link that, if clicked by a user already logged into ChatGPT Workspace Agents, silently created the rogue agent without any additional confirmation.

The planted agent operated with the victim’s identity and access rights, polling the attacker’s commands every five minutes and executing them undetected. Zenity Labs demonstrated that such an agent could extract documents, map internal structures, harvest credentials, and impersonate the user across connected services.

Attack Requirements and Potential Impact

Successful exploitation required the targeted employee to be logged into ChatGPT with Workspace Agents enabled and at least one enterprise connector already authorized, such as Outlook, Gmail, Slack, or SharePoint. No security prompts appeared to alert the user to unusual activity.

Unlike traditional cross-site request forgery, which typically triggers a single unauthorized action, AgentForger established a persistent, operational agent that functioned as a forged insider. Zenity Labs co-founder and CTO Michael Bargury described the threat as enabling attackers to plant an autonomous agent inside a company that carries the identity and access of its people.

Bargury further noted that a single click could deliver sustained access acting as a forged insider with disabled guardrails. The resulting agent possessed the ability to move data and perform actions across integrated platforms without raising immediate alarms.

Disclosure and OpenAI’s Response

Zenity Labs reported the vulnerability to OpenAI through the Bugcrowd program on June 4, 2026. OpenAI confirmed the finding the following day and issued a security fix by June 8, removing the hazardous URL parameter handling. Both parties stated they found no evidence that the flaw had been exploited in the wild prior to the patch.

OpenAI also announced plans to deprecate the legacy Agent Builder tool on November 30, 2026. Users will be directed toward the newer Agents SDK and Workspace Agents interface, which the company says offer improved safety controls.

Broader Implications for AI Agent Security

Security specialists have pointed to AgentForger as an example of a dangerous combination sometimes called the lethal trifecta: acceptance of untrusted inputs, connections to sensitive internal data sources, and the ability to perform unmonitored data exfiltration. This mix can convert convenient AI automation features into significant organizational risks.

The incident differs from cases in which AI models themselves bypass system boundaries. Instead, it shows how trust placed in agent-building platforms and pre-authorized connectors can be turned against the organizations that rely on them. As more enterprises adopt autonomous agents with deep integration into internal systems, researchers anticipate continued attention to these types of attack surfaces.