Critical ChatGPT AgentForger Flaw Lets Attackers Deploy Rogue Agents

Key Takeaways

• A critical flaw, dubbed “AgentForger,” was discovered in OpenAI’s ChatGPT Workspace Agents.
• The vulnerability allowed attackers to deploy rogue AI agents within a victim’s organization via a single phishing link.
• These malicious agents could silently access and exfiltrate sensitive data, impersonate users, and establish covert command-and-control.
• Zenity Labs reported the issue to OpenAI, which promptly patched the vulnerability on June 8, 2026.

ChatGPT AgentForger Flaw Enables Rogue Agent Deployment

Cybersecurity researchers have uncovered a severe vulnerability, named AgentForger, within OpenAI’s ChatGPT Workspace Agents. This critical flaw allowed malicious actors to silently create, configure, and publish fully autonomous, attacker-controlled AI agents inside a victim’s organizational environment, requiring only a single click on a phishing link.

Unlike conventional Cross-Site Request Forgery (CSRF) attacks, which typically manipulate a single request, AgentForger facilitated the complete orchestration of an autonomous AI agent, operating with the implicit trust of the victim’s enterprise infrastructure. This distinction elevates the threat significantly, as the rogue agent could then perform a wide array of unauthorized actions.

The Mechanics of the AgentForger Vulnerability

ChatGPT Workspace Agents are designed to integrate with essential enterprise services such as Outlook, Gmail, Slack, Google Drive, SharePoint, and Microsoft Teams. Under normal operational procedures, users interact with a conversational builder canvas to create and customize these agents.

However, an in-depth technical analysis by security researchers at Zenity Labs revealed a critical design flaw. The agent builder interface accepted its initial state directly through URL parameters, specifically template_name and initial_assistant_prompt. Crucially, the initial_assistant_prompt parameter did not merely pre-populate an input field; instead, its contents were automatically submitted and executed the moment the page loaded.

This architectural oversight allowed an attacker to craft a seemingly innocuous ChatGPT link containing a comprehensive set of malicious instructions. When a logged-in victim, who had previously authorized at least one connector, clicked this link, the Builder autonomously initiated the agent creation process. The rogue agent automatically connected to all previously authorized integrations and, alarmingly, switched the write-action approval setting from “Always ask” to “Never ask.” This effectively neutralized a primary security safeguard designed to prevent silent, sensitive actions.

Once forged, the agent was published live and scheduled to execute every five minutes. It would then poll a designated attacker inbox for commands prefixed with “TASK” and email the results back, thereby transforming ChatGPT into a covert command-and-control (C2) channel. Since the necessary connectors were already authorized from legitimate prior usage, no new OAuth consent screen appeared, providing no indication of compromise to the victim.

Potential Impact and Exploitation

Researcher Mike Takahashi demonstrated the extensive capabilities of such a forged agent. Acting as an “agentic insider,” it could map organizational structures, exfiltrate sensitive documents, harvest credentials, and impersonate the victim across various communication platforms like Slack, Teams, and email. These tactics mirror sophisticated AI-assisted phishing operations, highlighting the severe risk posed by this vulnerability.

Zenity attributes the AgentForger flaw to a combination of two fundamental architectural weaknesses:

1. Cross-Site Auto-Execution: The agent Builder’s readiness to execute unvalidated URL parameters immediately upon page load.
2. Overpermissive Natural-Language Control: The ability of natural-language prompts to modify critical security settings, such as approval policies and execution schedules.

These factors collectively formed what the researchers termed a “lethal trifecta”: untrusted input, access to private data, and an unmonitored channel for data exfiltration.

Resolution and Mitigation

Zenity reported the vulnerability to OpenAI via Bugcrowd on June 4, 2026. OpenAI promptly triaged and accepted the report within 24 hours, deploying a full patch on June 8, 2026. The fix involved removing the vulnerable URL parameter handler, effectively mitigating newly initiated attacks. Zenity confirmed that there was no evidence of active exploitation in the wild prior to the patch being applied.

Zenity’s subsequent analysis underscored the gravity of the flaw, demonstrating how a successfully forged agent could be commanded like a genuine insider threat, performing internal reconnaissance and facilitating business email compromise (BEC) schemes across an enterprise.

What You Should Do

• Ensure all software, especially AI-powered agents and integrations, is kept up to date with the latest security patches.
• Educate users about sophisticated phishing tactics, particularly those involving trusted application flows and unusual link structures.
• Implement robust security policies that restrict AI agents from modifying critical security settings without explicit, multi-factor authenticated user approval.
• Regularly audit the permissions and activities of all integrated AI agents within your enterprise environment.
• Monitor for unusual network traffic or C2 patterns originating from within your trusted application ecosystem.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.