ChatGPT workspace flaw let attackers forge AI agents

A security vulnerability in OpenAI's ChatGPT workspace agents allowed attackers to deploy rogue AI agents inside corporate accounts with a single click. The flaw, identified by security firm Zenity Labs, exploited the agent builder feature to create autonomous assistants that could access connected business applications under the victim's identity and permissions.

How the attack worked

The technique, dubbed "AgentForger," relied on tricking ChatGPT into processing malicious instructions embedded in what appeared to be a standard ChatGPT link. When clicked by a user with agent creation permissions, the link triggered the workspace to automatically configure, publish, and schedule an attacker-controlled AI agent. The agent could then leverage the victim's existing connections to services like Outlook, Teams, Slack, SharePoint, or Google Drive—provided the workspace allowed those actions.

Unlike traditional phishing methods that steal credentials or session tokens, this attack created a persistent insider threat. The rogue agent operated autonomously, using the victim's permissions to search corporate data, send messages, or exfiltrate documents. Zenity's proof-of-concept demonstrated how the agent could map organizational structures by scanning emails, chats, and calendars, or hunt for sensitive information like passwords and API keys in messages. Attackers could issue new tasks by sending emails with "TASK" in the subject line, turning the agent into a long-term corporate mole.

Impact and response

Zenity reported the vulnerability to OpenAI via Bugcrowd on June 4. OpenAI acknowledged the issue the following day and implemented a fix four days later by removing the URL parameter that enabled the attack. The patch was deployed before the flaw was publicly disclosed, preventing exploitation in the wild.

The attack surface highlighted by AgentForger extends beyond this specific bug. As AI agents evolve from passive assistants to active participants in corporate systems, they introduce new risks. Traditional security controls, such as endpoint protection or session monitoring, may not detect malicious agents operating within trusted environments. The incident underscores the need for granular permission models and behavioral monitoring for AI-driven workflows.

Broader implications

The AgentForger flaw illustrates a shift in attack vectors. Instead of breaching systems directly, attackers can now exploit the trust placed in AI agents to create insider threats. This method bypasses conventional security measures, as the malicious activity originates from within the organization's approved tools and permissions. As AI agents become more integrated into business processes, the distinction between software vulnerabilities and human-like threats will continue to blur.

Zenity's research also raises questions about the long-term security of AI-driven automation. Agents designed to act independently across multiple platforms may require new layers of oversight, such as real-time behavior analysis or AI-specific access controls. Without these measures, organizations risk exposing sensitive data to attacks that traditional security tools cannot detect.