A critical vulnerability in OpenAI's ChatGPT Workspace Agents could have let attackers deploy a malicious AI agent inside a company simply by tricking an employee into clicking a link. Security firm Zenity Labs, which discovered the flaw and dubbed it AgentForger, said OpenAI patched the issue on June 8, 2026. The attack weaponized ChatGPT's Agent Builder—a drag-and-drop tool for creating multi-step workflows—to secretly build, authorize, and launch an autonomous agent that operated under the victim's identity.

The exploit relied on a cross-site request forgery technique. Zenity found that Agent Builder accepted initialization parameters directly in the URL, including an agent template and a prompt that would automatically execute when the page loaded. An attacker could craft a link like chatgpt.com/agents/studio/new?template_name=chief-of-staff&initial_assistant_prompt=[malicious instructions]. If a logged-in user with access to Workspace Agents and at least one existing connector (to Outlook, Gmail, Slack, etc.) clicked the link, the Builder would immediately create a new agent, attach all available connectors, set approvals to "Never ask," publish the agent, and schedule it to run every hour.

The rogue agent then monitored the victim's email for messages from the attacker starting with "TASK" and executed those instructions—reading files, stealing passwords from Slack, or sending phishing links via Teams that redirected colleagues to fake login pages. Zenity noted that once deployed, the agent required no further clicks. It persisted via the hourly schedule, and the attacker could issue new commands through email. "AgentForger is an agent trust failure," said researcher Mike Takahashi. "The platform trusted that the user intentionally created, approved, scheduled, and operated the agent." The disclosure comes amid a broader wave of attacks on exposed AI infrastructure, including unauthenticated model servers and agent frameworks left on predictable ports.

Source: The Hackers News