One tampered ChatGPT link could spawn a rogue AI agent taking orders from an attacker every five minutes

AI security firm Zenity Labs has uncovered a significant vulnerability in OpenAI's Workspace Agents, which it named "AgentForger." The flaw allowed a single manipulated ChatGPT link to create a fully autonomous AI agent under an employee's account, with the agent inheriting the victim's identity and reusing their existing app permissions — bypassing approval steps meant to protect sensitive actions.

Zenity describes AgentForger as an evolution of classic cross-site request forgery (CSRF). In a typical CSRF attack, clicking a bad link triggers one unintended action. AgentForger went much further: it kicked off the creation of a fully autonomous agent that operated inside the company's trust boundary, tapped into connectors the victim had already authorized, and picked up new tasks from the attacker on a recurring schedule.

The vulnerability exploited how ChatGPT's Agent Builder handled URL parameters. The builder at chatgpt.com/agents/studio/new accepted template_name and initial_assistant_prompt parameters — but the page didn't just place the prompt value in the field; it also submitted and ran the prompt automatically. The only prerequisite was that the victim was logged into ChatGPT, had Workspace Agents access, and had authorized at least one connector like Outlook, Gmail, Slack, or Teams.

In Zenity's demonstration, the URL-embedded prompt guided the Builder through creating an agent named "TASK Mail Operator." It integrated all connected non-MCP connectors, set every permission requirement for reading, writing, and deleting to "Never ask," created schedules to run every five minutes, and checked Outlook for emails from the attacker with "TASK" in the subject line. The agent was built, published, and launched in Preview Mode — which Zenity notes is not a dry run but immediately executes against real accounts — without any user confirmation.

The scheduler transformed the attack into persistent command-and-control infrastructure. The agent woke up every five minutes, checked the inbox for new TASK emails, executed their instructions, and sent results back. In part two of its analysis, Zenity showed the agent mapping the organization, finding confidential documents including an M&A term sheet and board presentation in Drive and SharePoint, and discovering database credentials in Slack. The agent also sent phishing messages through the victim's Teams account.

Zenity reported the vulnerability through OpenAI's Bugcrowd program on June 4, 2026. OpenAI confirmed the report the next day and fixed the flaw on June 8 by removing the affected URL parameter, with Zenity praising the response time. The firm warns that traditional security tools are built for users and endpoints, not autonomous agents that act through legitimate identities — and AgentForger represents a new class of "agent trust failure" that the industry must address.