AgentForger: one bad ChatGPT link spawned a rogue AI agent

Key Takeaways

• A single manipulated ChatGPT URL could create an autonomous AI agent that inherited a victim's app permissions and ran attacker commands every five minutes
• The vulnerability exploited URL parameters in OpenAI's Agent Builder to skip approval steps and disable security controls automatically
• OpenAI patched AgentForger within four days, but researchers argue traditional security tools cannot handle threats from agents operating under legitimate user identities

A single tampered ChatGPT link could create an autonomous AI agent that silently checked an attacker's inbox for new orders every five minutes. Security firm Zenity Labs disclosed the vulnerability, dubbed AgentForger, in OpenAI's Workspace Agents on July 23, 2026. OpenAI patched it within four days, but the researchers argue the flaw represents a new attack class that traditional security tools cannot detect.

The attack required only that a victim was logged into ChatGPT, had Workspace Agent access, and had previously authorized at least one connector like Outlook, Gmail, Slack, or SharePoint. No new OAuth consent prompt appeared. One click on what looked like a productivity tip built, configured, and launched a persistent agent under the victim's identity.

How AgentForger evolved beyond classic CSRF

Zenity describes AgentForger as an evolution of cross-site request forgery. In a typical CSRF attack, a victim clicks a malicious link and unknowingly fires off a single authenticated action they never intended. AgentForger went further. Instead of triggering one request, the manipulated link kicked off the creation of a fully autonomous agent that operated inside the company's trust boundary, reused the victim's existing permissions, and picked up new tasks from the attacker on a recurring schedule.

Classic CSRF forges a request. AgentForger forges an entire agent.

URL parameters automated the entire agent creation flow

Creating a Workspace agent normally requires several interactive steps: selecting a template, entering instructions, connecting tools, reviewing sharing settings, testing in preview mode, and publishing. AgentForger bypassed most of this by abusing two URL parameters accepted by the Agent Builder at chatgpt.com/agents/studio/new.

The parameter template_name selected a starting template such as "chief-of-staff." The parameter initial_assistant_prompt supplied the instructions. Zenity found the page did not simply place that prompt value into a text field. It submitted and executed the prompt automatically.

Attackers did not need to send raw requests or directly manipulate the victim's browser. They only needed a chatgpt.com link with an attached prompt that looked harmless at first glance. The demo attack started with an ordinary-looking email pitching a productivity tip.

One click built, published, and launched the rogue agent

In Zenity's demonstration, the embedded prompt guided the Builder through a numbered task list. The agent was set up to integrate all already-connected non-MCP connectors, change every permission requirement for reading, writing, and deleting to "Never ask," create schedules to run every five minutes, check Outlook for emails from the attacker with "TASK" in the subject line, execute those instructions using the connected apps, and send results back unfiltered.

The Builder created an agent named "TASK Mail Operator" without prompting the user. It connected authorized services, disabled approval requirements, published the agent, and launched it in Preview Mode.

Here is the critical detail: Preview Mode was not a dry run. It executed the new agent against the victim's real connected accounts using the approval settings that had just been configured. Since every setting was already set to "Never ask," the first run finished without any user approval.

The scheduler gave attackers persistent access

Without scheduling, the attack would have been a one-time event. The scheduler transformed the forged agent into persistent infrastructure. By creating multiple hourly schedules offset by five minutes, the attacker ensured the agent polled for new commands every five minutes indefinitely.

From that point, the attacker could send an email with "TASK" in the subject line and an instruction in the body. The agent would read it, execute the task using the victim's app permissions, and email the results back. The victim might never notice.

What the rogue agent could exfiltrate

Zenity's proof-of-concept showed the agent mapping the victim's organization: listing employees, roles, Slack channels, and active projects. It also found database credentials sitting in Slack messages and sent them to the attacker in plain text.

The agent could also send phishing messages under the victim's identity via Teams, making internal social engineering trivial.

OpenAI patched in four days, but the broader problem remains

OpenAI fixed the AgentForger vulnerability within four days of Zenity's report. The company did not comment publicly on the timeline or remediation details.

Zenity argues the incident highlights a structural gap. Traditional security tools monitor for suspicious network traffic, anomalous API calls, or unauthorized identity tokens. An agent forged through AgentForger operates under a legitimate user identity with legitimate tokens, using connectors the user explicitly authorized. From the platform's perspective, every action looks normal.

The researchers believe organizations deploying autonomous agents need new controls: runtime monitoring of agent behavior, stricter scoping of connector permissions, and approval workflows that cannot be silently disabled by a prompt.

Frequently asked questions

Frequently Asked Questions

What is AgentForger?

AgentForger is a vulnerability in OpenAI's Workspace Agents that allowed a single manipulated ChatGPT link to create an autonomous AI agent under a victim's account, inheriting their permissions and executing attacker commands on a schedule.

Has OpenAI fixed the AgentForger vulnerability?

Yes. OpenAI patched AgentForger within four days of receiving Zenity Labs' report in July 2026.

How did the attack work without triggering OAuth prompts?

The attack reused connectors the victim had already authorized, such as Outlook, Slack, or SharePoint. Because no new permissions were requested, no OAuth consent prompt appeared.

What could an attacker do with a forged agent?

In Zenity's demo, the agent mapped the victim's organization, exfiltrated database credentials from Slack, and sent phishing messages via Teams under the victim's identity.

How can organizations protect against similar attacks?

Zenity recommends runtime monitoring of agent behavior, stricter scoping of connector permissions, and approval workflows that cannot be disabled programmatically by a prompt.

Source: The Decoder / Jonathan Kemper